BingX, a cryptocurrency exchange based in Singapore, has confirmed that it suffered a significant hack on 20 September 2024.
Initial reports estimated the loss at $26 million, but further investigation has revealed that the total damage has now surpassed $52 million.
The attack occurred early in the morning at around 4 AM (UTC+8). BingX’s technical team noticed unusual activity on the network and immediately suspected a cyberattack.
The exchange quickly took action to protect user funds by moving assets to secure locations and temporarily halting withdrawals from the platform. This swift response aimed to minimise the impact on users.
Blockchain security firm, PeckShield, was one of the first to report the incident. They identified a wallet on the Ethereum network that had received $26.7 million in assets from BingX.
Initially, this seemed to be the extent of the loss. However, further investigations revealed that the attack affected multiple blockchain networks.
A senior security expert at Cyvers Alerts, Hakan Unal, explained why the estimated loss continued to grow. “As more wallets are identified, the total loss grows”, Unal said.
He pointed out that early estimates of around $13 million were incomplete, as more evidence emerged showing the true extent of the hack.
“Updates from forensics firms now reporting figures like $43 million show a clearer picture”, he added.
“Our threat intelligence system has summed the total loss across all chains, leading to a more comprehensive estimate of $52 million.”
BingX assures users amid criticism
Despite the growing loss, BingX has tried to calm users, claiming that the damage is “minor”.
In a post on social media platform X, BingX CEO, Vivien Lin, confirmed that the breach took place but assured users that their funds are safe.
Lin explained that the exchange’s technical team detected the abnormal network activity at around 4 AM on 20 September.
The BingX security team immediately initiated emergency protocols, transferring assets out of the hot wallet, which is used for regular transactions, and halting all withdrawals. This was done to ensure that no further damage could be done.
“To ensure security, withdrawals have been temporarily suspended while we conduct an emergency inspection and strengthen wallet services”, Lin stated.
She apologised for the inconvenience caused and promised that withdrawals would be restored within 24 hours.
Lin also assured users that most of their funds were stored in cold wallets, which are not connected to the internet and therefore safer from hacks.
However, not everyone is convinced by BingX’s response. The co-founder of crypto startup g8keep, Harrison Leggio, criticised the exchange for not being transparent enough about the situation.
He questioned whether BingX’s explanation of “wallet maintenance” was an attempt to cover up a more serious problem, citing data from EtherScan that showed large transfers of funds from a BingX wallet, including a wallet labelled “BingX 15”.
This wallet had held $13.1 million earlier in the day, but by the time of the breach, it only held $9.5 million.
Surge in cyberattacks on Asian exchanges
BingX is just the latest in a series of cyberattacks on centralised cryptocurrency exchanges in Asia. These platforms, which hold large amounts of digital assets, have become prime targets for hackers.
Earlier in September, Indonesian cryptocurrency exchange Indodax lost $20.58 million in a similar hack. Just two months prior, India-based WazirX suffered one of the largest hacks of 2024, losing over $234 million in July.
Most of the stolen funds from the WazirX attack have since been laundered, with reports indicating that $6.5 million was recently sent to Tornado Cash, a crypto service used to anonymise transactions.
The largest attack this year, however, occurred on Japan’s DMM Bitcoin exchange in May. Hackers managed to steal a staggering $305 million in assets, making it the most severe breach of a crypto exchange so far in 2024.
Security experts believe that North Korea’s state-backed Lazarus Group is behind several of these attacks, including the incidents at Indodax, WazirX, and DMM Bitcoin.
In response to the growing threat, BingX has extended the processing times for deposits and withdrawals to allow for more thorough security checks.
The exchange has apologised for the inconvenience and promised to continue strengthening its wallet services to better protect user funds in the future.
