Coincidence or Targeted Attack? HTX Exchange, backed by Sun Yuchen, hacked post Poloniex incident

On November 22nd, on-chain data shows a withdrawal operation of 10,145 ETH on Heco Bridge. According to the PeckShield monitoring, this operation was conducted by a compromised operator. The reason for the asset theft involves a vulnerability in the Heco Bridge, which is used to transfer funds between Ethereum and the Heco chain (a blockchain established by the HTX exchange).

The attacker interacted with the Heco Bridge contract code, and the function used by the attacker, “withdrawNative,” allowed transferring a specified amount to a designated address but required a series of verification codes.

According to PeckShield analysis, a total of $86.6 million worth of assets were transferred, including 42 million USDT, 489 HBTC, and a series of other assets. PeckShield further stated that the outflow of funds was due to a compromised operator who had been operating since October 8, 2022.

In addition to cross-chain bridge transfer operations, the attacker conducted a series of exchange operations, converting the stolen assets into 31,281 ETH. With the initial 10,145 ETH, the attacker holds a total of 41,426 ETH.

Justin Sun has stated that he will fully compensate users for their losses and will airdrop assets to users holding funds on HTX and Poloniex.

As of November 27th, full deposit and withdrawal functionality has been restored for all major cryptocurrencies, including BTC, ETH, TRX, USDT, on HTX. Withdrawals for some ERC-20 tokens have also been resumed.

It's worth noting that another exchange backed by Justin Sun, Poloniex, was hacked on November 10th, with funds stolen totaling over a hundred million.