BitoPro confirms $11.5M exploit, says withdrawals unaffected

Key Points

  • BitoPro, a Taiwan-based cryptocurrency exchange, confirmed a security breach on May 8, resulting in a loss of over $11.5 million from its hot wallets across Ethereum, Tron, Solana, and Polygon.
  • The exchange delayed public disclosure of the exploit for weeks, only confirming it on June 2 via Telegram, stating the breach occurred during a wallet system upgrade.
  • Despite the incident, BitoPro assured users that withdrawals and funds are unaffected, with sufficient reserves and operational trading functions.
  • Stolen assets were moved to decentralized exchanges, mixed via Tornado Cash, or bridged to Bitcoin using THORChain, indicating attempts to obscure the funds' trail.
  • BitoPro has engaged a third-party blockchain security firm to trace the stolen funds and plans to share new hot wallet addresses for external investigation.

Summary

Taiwan-based cryptocurrency exchange BitoPro confirmed a security breach on May 8, resulting in a loss of over $11.5 million from its hot wallets on Ethereum, Tron, Solana, and Polygon. The exploit, disclosed weeks later on June 2 via Telegram, occurred during a wallet system upgrade when an attacker targeted an old hot wallet. Despite the incident, BitoPro assured users that their funds and withdrawals remain unaffected, with sufficient reserves and operational trading functions. Onchain investigator ZachXBT reported suspicious transactions to decentralized exchanges, with funds later moved to Tornado Cash or bridged to Bitcoin via THORChain to obscure their trail. BitoPro has commissioned a third-party security firm to trace the stolen assets and plans to share new hot wallet addresses for transparency. The delay in disclosure raised concerns, especially as some users reported issues withdrawing USDT after a brief maintenance period on May 9. This incident highlights the ongoing vulnerability of cryptocurrency exchanges and DeFi protocols to hacks, with recent exploits like Cetus ($220 million) and Nervos ($3 million) underscoring the critical threat of access control failures in Web3, as noted by Hacken analysts.

cointelegraph
June 3, 2025
Crypto
Read article

Related news