HTX (Huobi) hacked, $8 million lost

[Rikafip]

Justin Sun reported earlier today that HTX exchange (until recently known as Huobi) has been hacked for 5,000 ETH approximately worth $8 million. All funds are of course SAFU according to him, until they aren't.  So yeah, another reminder that storing your crypto on centralized exchange is not the smartest thing.



https://twitter.com/justinsuntron/status/1706311251024822748?s=20

[1714493515]

1714493515

[1714493515]

1714493515

[1714493515]

1714493515

[Oshosondy]

I think the site is still working completely normal. I have no money on the exchange though.

I have just logged in my Huobi account right now and I went straight to withdrawal, I did not see anything like withdrawal suspended. Login and trading activity are normal. I do not know if I will be able to withdraw if input the address, amount and press on withdraw.

If I have money there, I would have withdrawn it to test it.

[OmegaStarScream]

It's just getting ridiculous at this point with all of those hacks in the last few weeks:

- Atomic wallet (supposed to be non-custodial)
- Stake
- Coinex
- Mixin network
...

And the list goes on: https://hacked.slowmist.io/

[Bitcoin_Arena]

All I smell are just coordinated insider jobs and the blame keeps going to the "hackers" How does someone manage to withdraw 5,000 ETH without triggering any internal alerts or control measures?

Look at what the Justin thug tweeted  

$8 million represents a relatively small sum in comparison to the $3 billion worth of assets held by our users. It also amounts to just two weeks' revenue for the HTX platform.

We are willing to offer 5% of the stolen amount (400,000 USD) as a white hat reward to encourage the hacker to return the stolen funds. If the hacker returns the funds, we will also hire them as a security white hat advisor for HTX.

Ridiculous!!

[NotATether]

The very fact that he owns Huobi and changed it to something that sounds like FTX is not only trolling, it's a gigantic warning to get your funds out of there now.

Justin Sun is under the water in billions of dollars of debt. How do you think Huobi will survive this?

Look at what the Justin thug tweeted  

$8 million represents a relatively small sum in comparison to the $3 billion worth of assets held by our users. It also amounts to just two weeks' revenue for the HTX platform.

We are willing to offer 5% of the stolen amount (400,000 USD) as a white hat reward to encourage the hacker to return the stolen funds. If the hacker returns the funds, we will also hire them as a security white hat advisor for HTX.

Ridiculous!!

Dumbest attempt to turn a black hat into a white hat hacker I have seen.

[un_rank]

It's just getting ridiculous at this point with all of those hacks in the last few weeks:

It has always been ridiculous over the past few years. I do not think there has been a period where there was a significant drop in hacks from centralized exchanges ranging from loss of funds to loss of personal information. Basically anything stored with a third party should be considered compromised already.

Look at what the Justin thug tweeted 

$8 million represents a relatively small sum in comparison to the $3 billion worth of assets held by our users. It also amounts to just two weeks' revenue for the HTX platform.

We are willing to offer 5% of the stolen amount (400,000 USD) as a white hat reward to encourage the hacker to return the stolen funds. If the hacker returns the funds, we will also hire them as a security white hat advisor for HTX.

So return the money for 1/20 of the stolen amount with no guarantee of immunity? That is a ridiculous offer, makes us wonder if there are other previous hackers working behind the scenes in these exchanges to secure our assets.

- Jay -

[sokani]

This is really sad and another reason not to store one's asset on a centralized exchange, if it's not your coins it's not your assets. The list of hackers victims just keeps piling up and people who cannot avoid using CEXs to store their assets just have to learn the hard way.

I think the site is still working completely normal. I have no money on the exchange though.

I have just logged in my Huobi account right now and I went straight to withdrawal, I did not see anything like withdrawal suspended. Login and trading activity are normal. I do not know if I will be able to withdraw if input the address, amount and press on withdraw.

A user here, who wanted to sell his Bitcoin claimed Huobi has suspended deposit and when he tried contacting them to know the reason through their telegram link on their website, he got weird a message asking him to enter his seed phrase to claim 1000 USDT free giveaway. It looks like Huobi hasn't gotten control of the exchange from the hacker.  

[Rikafip]

Justin Sun is under the water in billions of dollars of debt. How do you think Huobi will survive this?

Even though probably in debt, I don't think that they will have issue surviving $8 million hack (withdrawals are possible since yesterday) but something of the size of recent Mixin hack might have ended completely differently.

A user here, who wanted to sell his Bitcoin claimed Huobi has suspended deposit and when he tried contacting them to know the reason through their telegram link on their website, he got weird a message asking him to enter his seed phrase to claim 1000 USDT free giveaway. It looks like Huobi hasn't gotten control of the exchange from the hacker.  

Yeah I saw his topic but I have no idea how he managed to get into that scam Telegram group because I just tested it and link on Huobi webiste leads me to their official TG groups/channels. So no, I don't think that those who hacked the exchange yesterday are in the control.

[Darker45]

This Justin Sun isn't just a clown and a big joke unto himself and to the businesses he lays his hands on, he is a bane of the entire crypto industry. His level of trollery is equal to that of CSW.

It is once again shown in his announcement of the hack. Only a troll announces a hack that has successfully stolen millions while declaring that funds are safe. Only a clown proudly announces that they have "addressed and resolved all issues" while at the same time offering monetary and even employment reward to the hacker just so that the stolen funds are returned. Only a joke brags about detecting the hack immediately and taking "swift action to prevent any losses" while saying that the platform has suffered a loss of $8 million.

Such a clown!

[Husires]

The first thing that happened to them after trying to improve their reputation and move to HTX was hacked, $8 million lost. This is a bad thing and they may need to change the name again to HHTX (kidding )
The $8 million lost will not constitute a loss that will lead to the bankruptcy of HTX, but it may be a test attack and what is to come is worse, so it is better to stay away from using it at least until publishing a detailed report on what happened and the necessary steps to ensure that this does not happen again, although I think it is difficult for them to gain trust again.

[sunsilk]

I have taken a look at Huobi's official Facebook page, and how ironic that before this incident has happened. A couple of days ago, they've posted and boasted that they've never had been any security issue. I'm not sure if that was the sign that exposed their security or it's just really a coincidence and they've never seen it coming.

#HTX Safe & Secure Since 2013!
Zero Security Incidents Since Inception

[Husires]

#HTX Safe & Secure Since 2013!
Zero Security Incidents Since Inception

Have they updated this news or are they still claiming that they are safe since 2013? I read some reports and found that Huobi cooperated several times to freeze hacked currencies, the last of which was several months ago, so perhaps this was the reason behind the hacking attempt.

[sunsilk]

#HTX Safe & Secure Since 2013!
Zero Security Incidents Since Inception

Have they updated this news or are they still claiming that they are safe since 2013? I read some reports and found that Huobi cooperated several times to freeze hacked currencies, the last of which was several months ago, so perhaps this was the reason behind the hacking attempt.

If I'll base that on their Facebook page, nothing has changed. They didn't even reported or posted that they were hacked unlike the other exchanges that have been hacked before.

So, they're boasting with that status based on their record where in fact that this has happened and yet they don't want to let their customers and soon-to-be customers know that this hack just happened recently.

Well, I'd say if they really are believing themselves and trustworthy then they should at least made some announcement about this. Or maybe, they're just waiting for a cooldown and will tell this when everything's okay and calm.

[ajiz138]

So return the money for 1/20 of the stolen amount with no guarantee of immunity? That is a ridiculous offer, makes us wonder if there are other previous hackers working behind the scenes in these exchanges to secure our assets.

Don't know. Never heard of a hacker being hired to secure customer assets. 
If hackers agree to this offer then what Justin is doing is ridiculous trying to give hackers another chance to get the HTX loophole. 

#HTX Safe & Secure Since 2013!
Zero Security Incidents Since Inception

Have they updated this news or are they still claiming that they are safe since 2013? I read some reports and found that Huobi cooperated several times to freeze hacked currencies, the last of which was several months ago, so perhaps this was the reason behind the hacking attempt.

If I'll base that on their Facebook page, nothing has changed. They didn't even reported or posted that they were hacked unlike the other exchanges that have been hacked before.

So, they're boasting with that status based on their record where in fact that this has happened and yet they don't want to let their customers and soon-to-be customers know that this hack just happened recently.

It seems that even HTX twitter does not report any hacks unless the CEO himself reports, maybe this is because he wants to cover up so that there is no doubt from users?

Justin said - has established a SAFU fund in anticipation of another attack, they also said they will continue to discuss the security mechanism of the exchange.

That's why they never announced on all HTX social media to prevent the news from spreading widely, even though I know some customers already know that HTX has been hacked and with Justin's ridiculous offer.

[sunsilk]

If I'll base that on their Facebook page, nothing has changed. They didn't even reported or posted that they were hacked unlike the other exchanges that have been hacked before.

So, they're boasting with that status based on their record where in fact that this has happened and yet they don't want to let their customers and soon-to-be customers know that this hack just happened recently.

It seems that even HTX twitter does not report any hacks unless the CEO himself reports, maybe this is because he wants to cover up so that there is no doubt from users?

Justin said - has established a SAFU fund in anticipation of another attack, they also said they will continue to discuss the security mechanism of the exchange.

That's why they never announced on all HTX social media to prevent the news from spreading widely, even though I know some customers already know that HTX has been hacked and with Justin's ridiculous offer.

I've tried to check again their Facebook account but there's no claiming and admitting that they were hacked. So I guess it's part of their plan and they're not going to tell anybody that they've been.

Although there's this post of theirs about Justin Sun too about:

Justin Sun, #HTX Global Advisory Board Member, brought valuable insights to the "Talk to Justin Sun about Crypto Safety Issues" live broadcast on Sept. 26th. He tackled security concerns in #crypto exchanges and more.

And there's this image of his on this particular post. They don't want to put it on public so that their customers aren't going to panic. Well, IMHO, that's not a good sign for their transparency.

[PX-Z]

Ironically using of hashtag #SAFU yet it was hacked. Although its just a small amount, yet it doesn't change the fact that they was hacked, and the platform should be labeled as not safe for the time being. Well, time for them to improve and upgrade their security.

[Rikafip]

Justin Sun announced yesterday that hacker who stole $8 million few weeks ago returned the full amount, and as a reward he got 250 ETH. Sounds good, but considering this news is coming from him, I would take it with a pinch of salt.


https://twitter.com/justinsuntron/status/1710687566792675553

[tabas]

Justin Sun announced yesterday that hacker who stole $8 million few weeks ago returned the full amount, and as a reward he got 250 ETH. Sounds good, but considering this news is coming from him, I would take it with a pinch of salt.


https://twitter.com/justinsuntron/status/1710687566792675553

Yeah, I would also put a grain of salt on that news if he's the one who just said that. It could just simply be another publicity for him and Huobi with such actions. Considering the reward after returning the whole amount, it's still a lot of money and that hacker did good with a great reward.
Maybe it will just be a matter of time until that hacker comes out to the public and shares his experience in some forums, either bitcointalk or Reddit or some white/blackhat forums. Anyway, it seems that it just happened quickly and that's just about less than a month with this hack in huobi.

[hugeblack]

Justin Sun announced yesterday that hacker who stole $8 million few weeks ago returned the full amount, and as a reward he got 250 ETH. Sounds good, but considering this news is coming from him, I would take it with a pinch of salt.

What is suspicious is that it is less than 10% or even 5%, which is often given to those who return stolen money. Are there independent third parties investigating such allegations, because what appears to be an employee did not receive his dues and then stole that money in exchange for getting what he wanted. Will the platform guarantee that it has become safer or actually enhance this, or is it money that was lost and recovered?
These responses are more likely to arouse suspicion than to be useful.

[sokani]

Yeah, I would also put a grain of salt on that news if he's the one who just said that. It could just simply be another publicity for him and Huobi with such actions.

The news of the returned stolen fund has circulated everywhere but I've also thought about what you said. Concerning how they pride the exchange to be unhackable, Justin Sun could easily tweet this to calm all fraying nerves down and to make HTX exchange look good in the eyes of the media. To back up his claim, I would have expected him to attach a transaction id of the returned stolen funds by the hacker.  Aside that, I just find it hard taking his words for it.