BingX Exchange Reveals Hot Wallet Attack, Assures Users of Full Compensation

Singapore-based cryptocurrency exchange company BingX revealed an attack on its hot wallet on September 20. The exchange assured users that it suffered no losses and fully compensated the amounts lost to the attack while admitting to minor asset losses.

Singapore-based cryptocurrency exchange BingX has revealed that it was subjected to a minor hack on September 20, wherein a small amount of cryptocurrency was drained from its hot wallet.

The exchange has assured its users that the majority of its assets were kept in cold wallets and remained untouched by the hackers. BingX also stated that it will fully compensate for the losses with its own capital.

According to Vivien Lin, Chief Product Officer of BingX, the exchange’s technical team noticed unusual traffic at 4 AM in Singapore time, prompting them to activate their disaster plan.

“We immediately moved assets and stopped withdrawal. While the loss is still being calculated, we confirm the following: 1) BingX will fully compensate for the loss with our own capital. 2) The total loss is minimal and manageable. This incident will not affect our ongoing business operations. Trading services continue as usual,” stated Lin in a post on X.

Most of BingX’s assets are kept in cold wallets and were not touched by the hackers, the exchange told its users. A small amount was kept in the hot wallet for instant transfers, and that was the asset that was drained.

Blockchain security startup PeckShield was the first to notice the suspicious movement of funds, estimating that over $13.5 million had been drained. Another analytics platform, Lookonchain, speculated that the amount could reach $26 million.

“Exchange #BingX seems to have been attacked, with more than 360 altcoins (worth more than $26M) being transferred to wallet ”0xF7e8″ and then swapped for $ETH and $BNB.

Including:

4.44M $USDT

1.04M $WUSD

608.7K $USDC

9.38 $BTCB ($590K)

86,545 $ZRO ($369K)

…… pic.twitter.com/YIVurrY0se

Despite these claims, Lin stressed that the hack would not affect BingX’s wider operations. She described the damages as “minor” and “manageable.”

“Following the hack, BingX has temporarily disabled withdrawals to carry out an emergency assessment and strengthen wallet security. Once these security enhancements are completed, in a day or two, withdrawals should be enabled again,” stated Lin.

The exchange’s hot wallet contained over 360 cryptocurrencies, including some of the largest coins. These included 4.44 million USDT, 1.04 million WUSD, and 9.38 BTCB ($590,000). All of the assets were sent to the address “0xF7e8” and quickly swapped for Binance Coin (BNB) and Ethereum (ETH).

Currently housed at “0x1D…AEE,” the stolen funds total 5.3K $ETH, 4.1K $BNB, and 1.65M $MATIC. Hence, considering all the additional transfers, the estimated loss amounts to over $43 million.

Data fetched from Etherscan also shows that a majority of the stolen funds were swapped for ETH and BNB on various decentralized exchanges (DEXs) like Uniswap and Kyberswap.

The recent hack attempt on BingX was large-scale, with a breach impacting over 360 cryptocurrencies and enabling the attackers to syphon 13.25 ETH among other valuable assets.

However, BingX’s assurance to compensate the users for their loss comes as welcome news to those affected by the hack, as the exchange steps up its security measures in an attempt to close any gaps.

In other news, a significant cyberattack was carried out on Indodax, the largest cryptocurrency exchange in Indonesia, on September 11, 2024, resulting in losses of $22 million.

Moreover, stablecoin issuers Tether, Circle, Paxos, and Techteryx have blocked wallets linked to hacks by the Lazarus Group in an effort to curb the rampant crypto hacks.