BingX: Unraveling the $44.7 Million Hack

In partnership with

In partnership with

TL;DR

BingX suffered a $44.7 million loss due to a sophisticated hot wallet hack, drawing comparisons to previous attacks, including a $25 million breach at Indodax. Blockchain experts raised concerns about potential state-sponsored involvement, prompting questions about the adequacy of security measures in centralized exchanges and the ongoing threat landscape.

Make Sure This Hack Doesn’t Happen To You 🫵

Subscribe to Blockbasis and get access to our premium scanner to check whether your the funds in your wallet is safeguarded from hacks 🔐

For a limited period only, you can get a 7 day FREE trial!

All for just $50/month after the trial.
Don't miss out! Grab your FREE trial today 👇

On September 19th, BingX, a centralized cryptocurrency exchange, experienced a substantial security breach resulting in the loss of $44.7 million from its hot wallets.

The breach was carried out by a highly sophisticated hacking group, who efficiently transferred the stolen funds across multiple blockchain networks.

In response, BingX's public relations team downplayed the severity of the incident, referring to it as a "minor" setback, attempting to minimize the impact of the eight-figure loss.

This incident underscores the persistent risks associated with hot wallet management and reiterates the importance of the crypto community's guiding principle: "Not your keys, not your crypto."

As with many crypto calamities, Crypto Twitter was the first to sound the alarm on BingX's security breach.

Tayvano, a prominent figure in the community, began listing the addresses involved in exploiting BingX, sparking a chain reaction of blockchain sleuthing.

Tayvano’s observations highlighted the multi-chain nature of the attack, foreshadowing the extensive damage.

Shortly after, blockchain security firm PeckShield alerted BingX to a suspicious $13.6 million outflow from their wallets.

Approximately an hour later, BingX acknowledged the situation with a vague "Temporary Wallet Maintenance Notice."

Vivien Lin, BingX's Chief Product Officer, then provided a more detailed statement on social media. Lin revealed that the team detected "abnormal network access" around 4 AM Singapore time, suspecting a hacker attack on their hot wallet.

BingX announced it had "immediately started our emergency plan, including the urgent transfer of assets and withdrawal suspension" following the discovery of the security breach.

Chief Product Officer Vivien Lin attempted to downplay the severity, calling it a "minor asset loss" and assuring users that most funds were securely stored in cold wallets.

The exchange promised to restore withdrawals within 24 hours and hinted at a compensation plan.

While BingX crafted its PR narrative, Cyvers painted a more alarming picture.

According to SlowMist, the total damage amounted to $44.7 million across multiple chains, including Ethereum, BNB Chain, Polygon, and others.

The attack involved multiple addresses, suggesting a coordinated effort or a particularly sophisticated attacker.

Digital fingerprints of the heist were scattered across the blockchain, with at least ten confirmed exploiter addresses and three additional suspected addresses involved in the attack.

Address 1: 0xf7e8033366166f92eb477b7b38e0d47d47b43326

Address 2: 0xb0146aec3593410c8307b570af69adf4d74678b3

Address 3: 0x940362b46faf7df48af1c8989d809f50466b5fca

Address 4: 0x1Dd7dAf089C16856155FeFd7e2170966bb6b3AEE

Address 5: 0x719981cf7D1a1dC681a1cf0C6B1eeeE090D0FEd6

Address 6: 0xf26e64ef4300ca027d2ffedd7d765d7a3906091c

Address 7: 0xb77a4a9678315775c4ba89f18f84f87538e748f5

Address 8: 0x63dc352ddfc17aa04edac47ce36e186c1e54b02c

Address 9: 0x49284f0ab5098d7effb3392124903c081d1b9f7e

Address 10: 0xcfc14fa81226074036622976d95897ff84b58d66

Suspected Addresses:

Address 1: 0xc1B5a00871B89175bDC8F3b0de9Be3b29ffD3729

Address 2: 0x4D9D586567c9feA923c362c35385935Ee7781bf6

Address 3: 0xf36dd342A1D1C63aAddF9a95226349e527917fF3

The exact root cause of the BingX exploit remains shrouded in uncertainty, inviting speculation from experts and the crypto community alike.

Was it a sophisticated phishing attack, an inside job, or perhaps a latent vulnerability within BingX's security framework that was finally exploited? The complexity of the attack suggests a level of planning that would impress even seasoned cybercriminals.

As the investigation unfolds, a familiar figure has emerged, casting doubt on the true nature of the breach.

Hakan Unal, Senior Security Operations Lead at Cyvers, made a striking observation regarding the hacker's behavior.

He noted, “This hacker’s behavior—using multiple wallets to swap altcoins into ETH and BNB before consolidating—is consistent with the tactics we’ve seen in past Lazarus operations.”

This raises an intriguing question: Is this incident another notch on the belt of these notorious cybercriminals, or simply a convenient scapegoat for an industry grappling with security vulnerabilities? The answers remain elusive, but the implications are profound.

While the potential link to the Lazarus Group remains conjectural, it introduces an additional layer of complexity to an already intricate scenario.

Amid the deluge of analysis and speculation, blockchain investigator ZachXBT offered a stark critique that challenged BingX's portrayal as a victim.

He pointedly stated, “The second part of your statement is ironic, considering BingX has often been unhelpful to victims of stolen funds from pig butchering scams, Indian call scams, and real-life thefts. This security incident may prompt you to reassess your processes, as you rank among the least supportive in that regard.”

ZachXBT's remarks highlight a poignant irony: the exchange that has frequently ignored the pleas of scam victims is now grappling with the consequences of a significant heist.

As BingX races to mitigate the damage, both financially and to its reputation, the community watches with a blend of skepticism and intrigue.

Is this incident merely a temporary setback for BingX, or does it foreshadow a broader crisis looming over centralized exchanges? The unfolding situation could significantly influence public trust in this sector.

With advanced techniques at play and speculation about state-sponsored involvement, one must ponder whether we are witnessing the onset of a more perilous phase of crypto heists.

BingX's $44.7 million loss is not an isolated event; just over a week prior, Indodax, another Asian exchange, suffered a similar fate, losing $25 million to a comparable attack.

These consecutive breaches highlight a troubling trend of escalating threats and possibly inadequate defenses within the industry.

As exchanges scramble to bolster their security measures, users are left to reconsider the fundamental stability of centralized crypto trading platforms. The landscape is shifting, and the implications for investors and traders alike could be profound.

The assurance of "institutional-grade security" begins to ring hollow when millions of dollars can instantly disappear.

As the cycle of hacking, patching, and recurring incidents unfolds, a sense of déjà vu looms large.

Are we trapped in a relentless game of whack-a-mole against increasingly sophisticated attackers, or is this moment a catalyst for a fundamental reevaluation of exchange security?

The pressing question remains: are exchanges entering a gunfight with mere knives, or are the attackers simply operating several steps ahead? The answers could reshape the future of security in the crypto space.

Not An Influencer? Get Paid Like One!

Not an influencer? Not an A lister? Doesn't matter. Get paid like one with INMO! Start owning your content and getting paid for it. It's never too late to start that side hustle. INMO's daily challenges are fast, easy and exciting. Play $1 to play or vote. Enter daily challenges by either posting an original video, sourced video or voting for your favorite. Whether you’re showing off your skills or supporting the best, you’ve got a shot at winning cash every day. And yes, it really works!

Pay Me Like An Influencer!

Power your competitive advantage with intelligent automation from ELEKS

ELEKS' intelligent automation service transforms your business operations through data-driven solutions. We automate complex tasks, streamlining processes to increase productivity and reduce operational costs. Our tailored solutions adapt to your changing needs and help you unlock new growth opportunities by freeing your team to focus on high-value tasks.

The result? Enhanced customer satisfaction, improved client retention, and a stronger market position.

Talk to our automation specialists