Poloniex, HTX and Heco Bridge Hacks (Justin Sun ecosystem, Nov 2023)

Overview

Over a roughly two-week span in November 2023, three platforms in Justin Sun's crypto ecosystem, the Poloniex exchange, the HTX (formerly Huobi) exchange, and the Heco cross-chain bridge connecting HTX's Heco Chain to Ethereum, were hit by hacks that together drained on the order of $240 million, in a cluster that highlighted the concentration risk of multiple high-value platforms under common ownership and apparently shared infrastructure or key-management practices. The largest loss came first: on November 10, 2023, Poloniex, the exchange Sun acquired in 2019, lost more than $126 million (initial estimates around $60M were revised sharply upward) in what was assessed as a hot-wallet compromise, likely a private-key leak, draining ETH, TRON, USDT, TUSD and over 865 BTC, among other assets. Then on November 22, 2023, Sun confirmed exploits on HTX and the Heco bridge: the Heco bridge lost roughly $86 million (about 41,000 ETH-equivalent across USDT, ETH, HBTC, SHIB and other tokens, suspected to stem from a private-key leak of bridge signer addresses), and HTX itself lost around $30 million in a separate hot-wallet exploit. In each case, Sun publicly committed that the platforms were financially healthy and would fully reimburse affected users, and offered white-hat bounties to the attackers. The clustering of three breaches across commonly-owned platforms in such a short window strongly suggested a shared root cause in key-management or infrastructure security, and some investigators assessed the November activity as consistent with Lazarus. The episode is the canonical case study in common-ownership concentration risk and the systemic danger of shared key-management practices across a portfolio of platforms.

Timeline of the November cluster

The cluster began on November 10, 2023, when Poloniex, the exchange Justin Sun acquired in 2019, suffered a major hot-wallet compromise. Initial estimates put the loss around $60 million, but as analysts traced the outflows the figure was revised sharply upward to more than $126 million, encompassing Ethereum, TRON, the stablecoins USDT and TUSD, over 865 BTC, and various other tokens. Sun quickly stated that Poloniex remained financially healthy and would fully reimburse affected users, and Poloniex offered the attacker a 5% white-hat bounty with a seven-day deadline to return the funds. Then, on November 22, 2023, Sun confirmed a second wave of incidents across other parts of his ecosystem: the Heco cross-chain bridge, which connects HTX's Heco Chain to Ethereum, was exploited for roughly $86 million, with the stolen assets, including about 42 million USDT, around 10,145 ETH, 489 HBTC and 346.87 billion SHIB, largely converted into approximately 41,000 ETH; and the HTX exchange itself was separately exploited for around $30 million. As with Poloniex, Sun assured users that HTX and Heco were financially sound and that losses would be fully covered, and the affected platforms suspended deposits and withdrawals while investigating. The Heco bridge exploit was attributed to a suspected private-key leak affecting the bridge's signer addresses, mirroring the Poloniex hot-wallet-compromise pattern, and the close timing of three breaches across commonly-owned platforms drew immediate scrutiny of shared key-management or infrastructure as a common root cause.

Attack mechanism: a cluster of key compromises

The unifying technical theme across the November cluster is private-key / hot-wallet compromise rather than smart-contract logic bugs. The Poloniex breach was assessed as a hot-wallet compromise, the platform's hot wallets, holding the assets needed for day-to-day withdrawals, were drained, consistent with the attacker having obtained the private keys controlling those wallets (via leak, malware, or social engineering of personnel). The Heco bridge exploit was attributed to a suspected leak of the private keys of the bridge's signer/operator addresses: like any bridge, Heco's security depended on the keys authorizing movements of the locked assets, and compromise of those keys allowed the attacker to move the bridge's holdings, which were then consolidated into ETH. The HTX exchange exploit was a further hot-wallet compromise. The critical observation is not any single mechanism but the clustering: three platforms under common ownership, sharing some combination of personnel, infrastructure, operational practices and possibly key-management systems, were compromised within roughly two weeks. That pattern strongly implies a shared root cause, a weakness in the key-management or security practices common across the ecosystem, or a single adversary that, having compromised one part of the shared infrastructure or staff, was able to reach multiple platforms. Some investigators assessed the November activity as consistent with Lazarus methodology, though the cluster was not the subject of a formal government attribution like the later DMM and Bybit cases.

Root cause: common-ownership concentration risk

The deepest root cause illustrated by the November cluster is concentration risk arising from common ownership: when multiple high-value platforms (two exchanges and a bridge) are owned and operated by the same party and share infrastructure, personnel, or key-management practices, a weakness in the common layer becomes a systemic vulnerability that can compromise all of them. The near-simultaneous breaches of Poloniex, HTX and Heco are difficult to explain as three independent coincidences; the far more likely explanation is a shared weakness, whether in how private keys were generated, stored and accessed across the ecosystem, in the security of common operational infrastructure, or in the staff who administered multiple platforms, that the attacker exploited to reach several targets. This is the same category of lesson as supply-chain and shared-dependency risk seen elsewhere, applied to a portfolio of commonly-owned platforms: diversification of ownership does not exist within a single owner's portfolio, so the security of each platform is only as strong as the weakest shared practice. The specific mechanism, hot-wallet and bridge-signer key compromise, points to key management as the likely common weak point: if keys across the ecosystem were generated, stored, or accessed using common tooling, personnel, or procedures, a single compromise of that common element could cascade. The remediation is segregation, independent key-management, infrastructure and personnel for each platform, so that a breach of one cannot reach the others.

Response: full reimbursement and bounties

Justin Sun's response across all three incidents followed a consistent template: public assurance of solvency, a commitment to fully reimburse affected users from the platforms' own resources, and white-hat bounty offers to the attackers. For Poloniex, Sun stated the exchange was financially healthy and would cover all losses, and Poloniex offered a 5% bounty with a seven-day deadline; reporting indicated cooperation with law enforcement in multiple jurisdictions, including China, the United States and Russia. For HTX and Heco, Sun likewise assured users that the platforms were sound and that losses would be fully reimbursed, and the affected services suspended deposits and withdrawals during the investigations. The full-reimbursement commitment, backed by the resources of Sun's larger ecosystem, meant that, as in the DMM Bitcoin case, the operator absorbed the loss rather than passing it to users, an outcome that protected depositors but did not undo the security failures or the reputational damage. The white-hat bounty approach, offering the attacker a percentage to return the funds, is a standard first move; its success rate is mixed and depends on whether the attacker calculates that the bounty exceeds what they can safely launder. In this cluster, the bulk of the stolen value was laundered rather than returned, with the Heco proceeds consolidated into ETH and moved on, consistent with a sophisticated, possibly DPRK-linked, adversary.

Industry implications and verdict

The November 2023 Justin Sun-ecosystem cluster is the canonical case study in common-ownership concentration risk and the systemic danger of shared key-management practices across a portfolio of platforms. Several lessons follow. First, common ownership does not provide diversification: if one entity owns multiple high-value platforms that share infrastructure, personnel or key-management, a single weakness in the common layer can compromise all of them, and the appropriate mitigation is rigorous segregation, independent key custody, infrastructure and staff per platform, so a breach cannot cascade. Second, the cluster reaffirms that hot-wallet and signer-key security is the central control for exchanges and bridges alike: the assets are only as safe as the keys, and those keys must be protected with hardware-backed custody, multisig with independent signers, strict access controls, and monitoring for anomalous outflows. Third, the full-reimbursement response, while protective of users, illustrates that a well-resourced operator can absorb even a $240M cluster of losses, but absorbing losses is not a substitute for preventing them, and the reputational cost and the underlying security questions remained. Fourth, the assessment by some investigators that the activity was consistent with Lazarus situates the cluster within the broader pattern of DPRK targeting of crypto platforms, and within the specific reality that a high-profile, multi-platform ecosystem is an attractive target precisely because compromising shared elements can yield multiple paydays. The verdict is that the Poloniex/HTX/Heco cluster belongs in the record as the definitive common-ownership-concentration-risk case, a reminder that owning many platforms multiplies the attack surface unless each is rigorously and independently secured.

Recovery

Justin Sun committed to fully reimburse users across all three incidents from the platforms' resources, protecting depositors; affected services suspended deposits/withdrawals during investigations. Poloniex offered a 5% white-hat bounty (seven-day deadline) and cooperated with law enforcement across multiple jurisdictions. The bulk of the stolen value was laundered rather than returned (Heco proceeds consolidated into ETH).

Frequently asked questions

Related

• DMM Bitcoin Hack and Shutdown (May 31, 2024)
• Orbit Bridge Multisig Hack (Dec 31, 2023)
• Mixin Network Cloud-Database Hack (Sep 23, 2023)
• WazirX Exchange Hack (Jul 18, 2024)
• justin sun
• ethereum
• tron