Poloniex

Poloniex Security Incident - November 10, 2023

Overview

Justin Sun's cryptocurrency exchange Poloniex suffered a significant security breach on November 10, 2023, resulting in the theft of approximately $126 million in digital assets from the platform's hot wallets.

What Happened

The incident commenced at 10:30 AM UTC when attackers gained unauthorized access to Poloniex's hot wallet infrastructure. The exchange initially concealed the breach by announcing wallet "maintenance" before Sun publicly acknowledged the situation roughly one hour later.

Attack Vector

The article indicates that exchange hacks typically stem from "off-chain attack vectors, with the aim of gaining access to a device or an employee in order to extract private keys." No specific technical vulnerability was disclosed publicly at the time of reporting.

Financial Impact

Total Loss: $126 million across multiple blockchains

• USDT: $33 million (22M on TRON, 11M on Ethereum)

• ETH: $10 million (4,900 ETH on Ethereum)

• Bitcoin: $32.6 million total (18.6M native BTC, 14M BTC on TRON)

• USDC: $5 million on Ethereum

Additional Loss: Approximately $2.6 million in GLM tokens were accidentally transferred to the token contract during liquidation.

Attacker Addresses

Ethereum: 0x0a5984f86200415894821bfefc1c1de036dbf9e7

TRON: TKK6d1YALy8HCSoCSWWd1ZJhyC9NPPx4wa

Bitcoin: bc1qnpc7u2ha7ct9c458rrqsawylz9e9j6jvkvzttt

Stolen assets were dispersed across numerous secondary addresses for token swapping and obfuscation.

Response & Recovery Efforts

• Justin Sun pledged full reimbursement to affected users

• Poloniex offered a 5% bounty for fund recovery

• Arkham Intelligence posted a $4,000 bounty for hacker identification

• A seven-day grace period was offered for voluntary fund return

Notable Outcomes

The attacker inadvertently pumped TRX (Justin Sun's token) by 25% when converting stolen TRON-based USDT, offsetting some recovery costs for the exchange operator.