{"id":84977,"date":"2023-09-25T17:31:16","date_gmt":"2023-09-25T14:31:16","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=84977"},"modified":"2025-09-12T20:36:44","modified_gmt":"2025-09-12T17:36:44","slug":"unknown-attackers-siphon-7-9-million-from-htxs-hot-wallet","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/unknown-attackers-siphon-7-9-million-from-htxs-hot-wallet\/","title":{"rendered":"Unknown attackers siphon $7.9 million from HTX&#8217;s hot wallet"},"content":{"rendered":"<p>On September 24, hackers attacked HTX&#8217;s hot wallet (formerly Huobi), resulting in the loss of 5,000 ETH ($7.9 million). The suspicious transaction was detected by Cyver Alerts.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">?Red Code?Yesterday, our ML-powered system detected a suspicious transaction involving <a href=\"https:\/\/twitter.com\/HuobiGlobal?ref_src=twsrc%5Etfw\">@HuobiGlobal<\/a> and <a href=\"https:\/\/twitter.com\/HTX_Global?ref_src=twsrc%5Etfw\">@HTX_Global<\/a>.<br \/>Despite our attempts to reach out, we received no response. An EOA received 5K <a href=\"https:\/\/twitter.com\/search?q=%24ETH&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$ETH<\/a> $7.9M from <a href=\"https:\/\/twitter.com\/HuobiGlobal?ref_src=twsrc%5Etfw\">@HuobiGlobal<\/a>&#8216;s hot wallet.<\/p>\n<p>? This morning, we spotted\u2026 <a href=\"https:\/\/t.co\/3oqHhAVi8P\">pic.twitter.com\/3oqHhAVi8P<\/a><\/p>\n<p>\u2014 ? Cyvers Alerts ? (@CyversAlerts) <a href=\"https:\/\/twitter.com\/CyversAlerts\/status\/1706301345223897506?ref_src=twsrc%5Etfw\">September 25, 2023<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Subsequently, the hacker moved 1,001 ETH to another wallet.<\/p>\n<p>Following the incident, HTX&#8217;s team migrated the hot wallet. It also sent to the hacker&#8217;s wallet a <a href=\"https:\/\/etherscan.io\/address\/0x18709e89bd403f470088abdacebe86cc60dda12e\">\u0442\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0438\u044e \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435\u043c<\/a>, which identified him. The exchange offered to voluntarily return the funds by October 2 and receive a 5% bounty; otherwise the platform intends to refer the matter to law enforcement.<\/p>\n<p>Later, the hack was confirmed by Tron founder Justin Sun, who sits on the <a href=\"https:\/\/forklog.com\/en\/news\/media-outlets-name-justin-sun-as-huobi-buyer-tron-founder-denies-rumours\">advisory council<\/a> of HTX.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">HTX <a href=\"https:\/\/twitter.com\/HTX_Global?ref_src=twsrc%5Etfw\">@HTX_Global<\/a> has suffered a loss of 5,000 <a href=\"https:\/\/twitter.com\/hashtag\/Eth?src=hash&#038;ref_src=twsrc%5Etfw\">#Eth<\/a> ($8 million USD) due to a hacker attack. HTX has fully covered the losses incurred from the attack and has successfully resolved all related issues. All user assets are <a href=\"https:\/\/twitter.com\/hashtag\/SAFU?src=hash&#038;ref_src=twsrc%5Etfw\">#SAFU<\/a> and the platform is operating completely normally.<\/p>\n<p>\u2014 H.E. Justin Sun \u5b59\u5b87\u6668 (@justinsuntron) <a href=\"https:\/\/twitter.com\/justinsuntron\/status\/1706311251024822748?ref_src=twsrc%5Etfw\">September 25, 2023<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to him, the exchange fully covered the losses incurred as a result of the attack, &#8220;having resolved&#8221; the related issues.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;All user SAFU resources are safe, and the platform is operating normally,&#8221; wrote Sun.<\/p>\n<\/blockquote>\n<p>He did not provide further details.<\/p>\n<p>Earlier, ForkLog reported that on September 23 an unknown attacker breached cloud-service provider Mixin Network and <a href=\"https:\/\/forklog.com\/en\/news\/mixin-network-hacked-for-200-million\">withdrew about $200 million<\/a> in digital assets.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On September 24, hackers attacked HTX&#8217;s hot wallet (formerly Huobi), resulting in the loss of 5,000 ETH ($7.9 million).<\/p>\n","protected":false},"author":1,"featured_media":84978,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[44,230],"class_list":["post-84977","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybercrime","tag-huobi"],"aioseo_notices":[],"amp_enabled":true,"views":"20","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/84977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=84977"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/84977\/revisions"}],"predecessor-version":[{"id":84979,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/84977\/revisions\/84979"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/84978"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=84977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=84977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=84977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}