Crypto exchange BingX confirmed that it experienced a “minor asset loss” after detecting suspicious outflows from one of its hot wallets.
In a post on Sept. 20, BingX’s Chief Product Officer Vivien Lin stated that the exact amount stolen from the breach was still under evaluation and that the incident occurred around 4:00 A.M. Singapore time.
However, blockchain security firm Cyvers estimates the breach caused over $52 million in losses, with most assets already swapped. The affected chains include Ethereum, Binance Smart Chain, Base, Optimism, Polygon, Arbitrum, and Avalanche.
Hakan Unal, Senior Security Operations Lead at Cyvers, told CryptoSlate that the attacker’s rapid asset-swapping moves show similarities to the techniques of North Korea-backed malicious actors. Unal stated:
“This hacker’s behavior—using multiple wallets to swap altcoins into ETH and BNB before consolidating—is consistent with the tactics we’ve seen in past Lazarus operations.”
Temporary service suspension
Following the breach, Lin announced that BingX temporarily halted withdrawals to conduct an “emergency inspection” and strengthen its wallet security. She reassured users that withdrawals would resume within 24 hours.
She stated:
“To ensure security, withdrawals have been temporarily suspended while we conduct an emergency inspection and strengthen wallet services. We sincerely apologize for the inconvenience. Withdrawals will be restored within 24 hours at the latest.”
Lin also highlighted the exchange’s layered management system, which keeps most assets in cold wallets, leaving only a small portion in hot wallets for withdrawals.
In a separate statement, Lin assured users that BingX would “fully compensate” for any losses from its capital while emphasizing that user assets remained secure.
Escalating CEXs hacks
This incident highlights the growing trend of hackers targeting centralized exchanges (CEXs). Earlier this year, blockchain security firm Chainalysis reported a resurgence in attacks on CEXs, shifting attention away from DeFi platforms.
Examples of recent attacks include the $305 million hack on Japan’s DMM Bitcoin platform and the $235 million breach of India’s WazirX exchange in July. Indonesia’s Indodax exchange also saw around $20 million in losses following a recent attack.
Security experts have linked the hacks to North Korean actors in all cases. Over the past seven years, these hackers are believed to have stolen over $3 billion in digital assets.
