BitoPro confirms $11.5M exploit, says withdrawals unaffected

[_act_]

Taiwan-based exchange BitoPro confirmed an $11.5 million crypto exploit weeks after the breach, saying user funds and withdrawals were unaffected. The exchange hot wallets on Ethereum, Tron, Solana and Polygon, saw asset outflows to decentralized exchanges (DEXs) where they were later marked as sold, according to onchain investigator ZachXBT. The assets were deposited into cryptocurrency mixer Tornado Cash or bridged to Bitcoin via THORChain.

In a June 2 Telegram post, the exchange said the breach occurred during a wallet system upgrade, when an attacker exploited an “old hot wallet” during internal fund reallocation. The platform has “sufficient virtual asset reserves,” and user withdrawals are “completely unaffected,” BitoPro stated.

I copied it from: https://cointelegraph.com/news/bitopro-exchange-11-5m-suspicious-outflow

I think many exchanges are now able to withstand hack to certain degree now. I can remember that BingX, Bybit and this exchanges now suffered exploits but they are still existing today.

But my advise will still be that people should not leave their coins on exchanges, but traders are enjoying now than before because they are the one that necessarily having money on exchanges.

[Wiwo]

This is another insider influence hack, although the safu covers all loses to hack that is the insurance from exchanges, much more also the fact that the hot wallet vulnerable is on the exchange and the dev teams.

Customers found can never be affected if their want to continue operation.

[hugeblack]

Tornado Cash is a mixing protocol, not a crypto mixer. To say that any hacks that occur are being mixed by Tornado Cash or THORChain demonstrates the laziness of ZachXBT or any of the onchain investigators services.

[_act_]

Tornado Cash is a mixing protocol, not a crypto mixer. To say that any hacks that occur are being mixed by Tornado Cash or THORChain demonstrates the laziness of ZachXBT or any of the onchain investigators services.

I think ZachXBT is the most well know individual or so that let people know about scams and exploits related to cryptocurrencies. I do not think it should be called lazy with everything he has done. Also I get this through a news and they can add their own to it. ZachXBT called it just Tornado Cash. But with my knowledge about mixers, Tornado Cash is still one of them.

[free-bit.co.in]

Tornado Cash is a mixing protocol, not a crypto mixer. To say that any hacks that occur are being mixed by Tornado Cash or THORChain demonstrates the laziness of ZachXBT or any of the onchain investigators services.

So its really good to see that BitoPro has come out as more resilient to hacks.
They proved that they have the ability to bear huge responsibility when it comes to being more professional.
$11.5 million exploit but they handled everything without affecting any users withdrawals.

You are right, people refer Tornado Cash as a mixer but it is not, technically it is smart contract based privacy tool.
whatever they are, this service is used for hacking & laundering activities so sanctions and legal challenges should be appropriate against them.

Here, users are not completely faultless either. their lack of knowledge is one of the main reasons for getting hacked.
we shouldn't store a huge amount of crypto on any exchange, no matter how faithful they are.
if you are not much active in trading then store your Bitcoin in your HD wallet, not an exchange.

[Darker45]

To confirm a successful attack after almost a month doesn't seem right. Did they plan to hide it from their users? It's a question of transparency and integrity if an exchange doesn't give an immediate heads-up to their users of a confirmed breach.

While it's a good thing to realize that centralized exchanges that were once victims of hacks are still operating until today, the fact that not just many but almost all of them have been hacked means they aren't to be completely trusted. Leaving funds to their custody is to be treated as a huge risk.

[yhiaali3]

In a June 2 Telegram post, the exchange said the breach occurred during a wallet system upgrade, when an attacker exploited an “old hot wallet” during internal fund reallocation. The platform has “sufficient virtual asset reserves,” and user withdrawals are “completely unaffected,” BitoPro stated.

I sense from this statement that some BitoPro officials were involved internally. How did the attackers know about such a sensitive time? A vulnerability arises during a wallet system upgrade, and such sensitive information can only be obtained from senior BitoPro officials.

I don't expect the hacker to have obtained the information by chance and carried out his attack at this sensitive time, unless he was a BitoPro employee or in collaboration with a senior employee. This isn't the first incident involving the involvement of officials from hacked platforms.

[avp2306]

Taiwan-based exchange BitoPro confirmed an $11.5 million crypto exploit weeks after the breach, saying user funds and withdrawals were unaffected. The exchange hot wallets on Ethereum, Tron, Solana and Polygon, saw asset outflows to decentralized exchanges (DEXs) where they were later marked as sold, according to onchain investigator ZachXBT. The assets were deposited into cryptocurrency mixer Tornado Cash or bridged to Bitcoin via THORChain.

In a June 2 Telegram post, the exchange said the breach occurred during a wallet system upgrade, when an attacker exploited an “old hot wallet” during internal fund reallocation. The platform has “sufficient virtual asset reserves,” and user withdrawals are “completely unaffected,” BitoPro stated.

I copied it from: https://cointelegraph.com/news/bitopro-exchange-11-5m-suspicious-outflow

I think many exchanges are now able to withstand hack to certain degree now. I can remember that BingX, Bybit and this exchanges now suffered exploits but they are still existing today.

But my advise will still be that people should not leave their coins on exchanges, but traders are enjoying now than before because they are the one that necessarily having money on exchanges.

Its like they are doing a damage control since it takes almost 1 month before they admitted that their exchange has been hacked https://www.cryptonewsz.com/bitopro-confirms-hack-after-zachxbt-flags-possible-11-5m-exploit/

But good thing that they can compensate and make sure that their depositors funds is safe.

Also maybe better for them next time to be transparent since people might think about that the hacking is an inside job if they hide those incident especially to people used their platform.

[_act_]

So its really good to see that BitoPro has come out as more resilient to hacks.
They proved that they have the ability to bear huge responsibility when it comes to being more professional.
$11.5 million exploit but they handled everything without affecting any users withdrawals.

Although $11.5 million is not a huge amount of money. Maybe it would have been different with huge amount of money like $100 million and above like what happened to Bybit. But it is good that they did not let the hacker have access to more assets than the amount stolen.

You are right, people refer Tornado Cash as a mixer but it is not, technically it is smart contract based privacy tool.
whatever they are, this service is used for hacking & laundering activities so sanctions and legal challenges should be appropriate against them.

Can you explain the difference between mixers and the smart contract based privacy tools like Tornado Cash? Please explain it.

[hugeblack]

Can you explain the difference between mixers and the smart contract based privacy tools like Tornado Cash? Please explain it.

The main difference between them is that mixers are centralized entities that can be seized/shut down, while decentralized protocols are software codes and can be managed locally (decentralized), so governments go after developers.

In the case of mixers, you need complete trust in the service, the level of privacy, and that they do not collect data, while protocols allow you to control your data and level of privacy.

[Darker45]

Can you explain the difference between mixers and the smart contract based privacy tools like Tornado Cash? Please explain it.

The main difference between them is that mixers are centralized entities that can be seized/shut down, while decentralized protocols are software codes and can be managed locally (decentralized), so governments go after developers.

In the case of mixers, you need complete trust in the service, the level of privacy, and that they do not collect data, while protocols allow you to control your data and level of privacy.

I wonder, do mixers have to be centralized? So, when a service is decentralized it automatically can't be considered a mixer? And so it's like a misnomer to describe something as a decentralized mixer? Is it not possible for a smart contract alone in lieu of a centralized entity to do the pooling, reshuffling of funds or deposits, and the redistribution afterward?

Or why is it wrong to casually label a decentralized protocol like Tornado Cash, for example, as a mixer when its rules are precisely designed for mixing? Or is all this just a case of technical nuance such that Tornado Cash itself isn't strictly the mixer because it only provides the framework or the protocol for mixing? In which case, it's essentially a mixer?

[Z-tight]

I think many exchanges are now able to withstand hack to certain degree now. I can remember that BingX, Bybit and this exchanges now suffered exploits but they are still existing today.

Bybit are still in operation because they received aid from other industry players after they lost $1.5B, yeah they are still in operation, but who is sure that they are truly solvent, many insolvent services run for sometime, until they cannot anymore. However, it depends on the service and how much they lost, if a small exchange loses a large amount of money, they are surely going to collapse, unless they can recover the funds.