HTX (ex Huobi)

Documented and closed events. They stay on file: an operator’s past is data, not a verdict.

1. Nov 22, 2023 Hack / funds theft Critical ✓ resolved

   HTX's hot wallets and the HECO cross-chain bridge drained on the same day: between 97 and 115 million dollars according to the press, deposits and withdrawals suspended, the fourth attack in two months on companies linked to Justin Sun. Full reimbursement was promised publicly; the bridge never came back and the HECO chain was shut down in January 2025

   On 22 November 2023 the hot wallets of the HTX exchange (formerly Huobi) and the HECO cross-chain bridge — the chain HTX built to move assets cheaply between blockchains — were drained on the same day. Justin Sun, founder and adviser to the platform, confirmed the attack that same day on his X account: «HTX and Heco Cross-Chain Bridge Undergo Hacker Attack. HTX Will Fully Compensate for HTX's hot wallet Losses». Deposits and withdrawals were suspended on both platforms as a precaution. THE FIGURE: WHY WE DO NOT WRITE JUST ONE. The sources do not converge, and putting a single number on the card would give an air of precision the facts do not have. On the exchange's hot wallets: an HTX spokesperson mentioned about 30 million dollars (South China Morning Post), while two days later the company revised its own count to 13.6 million; other accounts say 12.5 million. On the HECO bridge: 86.6 million per Cointelegraph, 83.4 million per other on-chain readings, «more than 85 million» per SCMP. Published totals therefore range from 97 million (CoinDesk) to 115 million (CNBC, which explicitly writes «so far»). What the sources do agree on is the order of magnitude — about one hundred million dollars — and the split: the large part is the bridge, not the exchange. THE CAUSE. Security firm Cyver, cited by CoinDesk, points to a suspected private key leak as the vector of the attack on the HECO bridge; for the exchange's hot wallets several independent analyses suggested a phishing attack. HTX has never published a technical post-mortem confirming either hypothesis. The context should be recorded too, because it is part of the fact: according to CNBC and SCMP this was the fourth attack in two months on HTX and entities linked to Justin Sun. WHAT HAPPENED NEXT. Services reopened on 24 November 2023, a little over 24 hours after the announcement, with the statement that «the funds lost during this incident constitute only a minor fraction of the platform's total capital» and a commitment to «100% safety of user funds». The market responded anyway: in the following weeks the platform recorded about 258 million dollars of net outflows (PYMNTS, Business Standard, December 2023) — more than double what was stolen. THE BRIDGE NEVER CAME BACK, AND THAT IS THE PART THAT WEIGHS MOST ON HECO USERS. The HECO chain was not restored: it was shut down. Users holding HRC20 assets were told to deposit them on HTX by 10 January 2025; deposits were converted into points, then redeemed in the HTX token distributed in 12 tranches from 15 January 2025. That is an orderly wind-down, not a restitution: whoever held assets on HECO received a different asset, on terms set by the company, and whoever missed the window received nothing. WHY WE MARK IT CLOSED, AND WHAT REMAINS UNVERIFIED. The fact is closed: operations were restored in two days, almost three years have passed, and the chain involved has been formally wound down. But «full reimbursement» remains a company statement: there is no public accounting, by the company or by third parties, documenting how many users were compensated and for how much, and Sun's promise explicitly covered only HTX's hot wallets, not the bridge.

   ↗ source
2. Sep 24, 2023 Hack / funds theft Moderate $8M ✓ resolved

   5,000 ether (about 7.9 million dollars) taken from an HTX hot wallet: the attacker returned all of it on 7 October 2023 after a public bounty offer, and HTX paid them a 250 ETH «whitehat bonus»

   Overnight between Sunday 24 and Monday 25 September 2023, about 5,000 ether — just under 8 million dollars at the time — were taken from an HTX hot wallet. Justin Sun publicly confirmed the episode and stated that the company had already covered the loss, adding that it represented a minimal fraction of the platform's reserves. THE PUBLIC NEGOTIATION. Instead of going straight to the authorities, HTX offered the attacker a 5% bounty on the funds (about 400,000 dollars) and, publicly, a security adviser role, giving them a week before law enforcement would be involved. On 7 October 2023 the attacker returned the entire sum in two transactions, of roughly 4,000 and 1,000 ether. Sun confirmed: «We have confirmed that the hacker has fully returned all funds, as promised, and we have also paid the hacker a whitehat bonus of 250 ETH». WHY IT STAYS ON THE CARD EVEN THOUGH THE MONEY CAME BACK. The outcome is the best possible one — no user lost anything and the matter closed in thirteen days — which is why the severity here is «moderate» and not «critical». But the fact remains relevant for two reasons. First: the loss was possible because a hot wallet key turned out to be usable by an outsider, and two months later the same kind of exposure cost far more (the incident of 22 November 2023). Second: the return depended on the attacker's voluntary choice after a negotiation, not on a technical control or an insurance cover — it is not a mechanism a user can count on.

   ↗ source

verified on Sep 30, 2026

Weighted average across 2 public review platforms (43,762 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.