Paxos
Hack or exploit on Sep 11, 2023 · Transfer Vulnerability
What happened
Stablecoin issuer Paxos admitted in a statement that the account that paid out nearly 20 BTC in fees in a single transaction in the early hours of September 11 belonged to the company. Paxos claims that end users have not been affected and all user funds are safe. The announcement comes after users on twitter speculated that PayPal could be responsible for the transaction, as analytics platform OXT identified relevant wallet accounts belonging to PayPal. A Paxos spokesperson said: "PayPal takes no responsibility for this as this error was caused by Paxos itself. This transaction affected Paxos company operations, Paxos customers and end users were not affected, and all customer funds are safe. This was caused by a vulnerability in a single transfer, which has now been fixed. Paxos is contacting miners to recover the funds."
Details
- Date
- Sep 11, 2023
- Kind
- Hack or exploit
- Method
- Transfer Vulnerability
- How in
- Smart contract bug
- Target
- Centralized exchange
- Chains
- Bitcoin
After the theft
- Recovered or frozen
- $499K
“$499K taken, $0K after recovery or freezing” (Web3 Is Going Great)
Reported by
SwanBluechip, "Paxos hack, Sep 11, 2023: $500K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htb2a1954044/ (data as of 2026-10-31).