BINGX

DESCRIPTION OF EVENTS

"Founded in 2018, BingX is a leading crypto exchange offering spot, derivatives, copy trading, and asset management. Experience a trustworthy platform that empowers you with innovative tools to elevate your trading game."

"BingX" "OFFICIAL CRYPTO EXCHANGE PARTNER OF CHELSEA FC"

"A global digital services financial institution with branch offices in Canada, the EU, and Australia Regulated business and services in countries where it operates"

"Robust identity verification, compliance and Know Your Customer (KYC) with Sumsub as a partner Auto-detection of cybercrime-related risks with advanced AI technology"

"100% Proof-of-Reserves with top cybersecurity organizations as partners Security audit approved by the leading security-focused ranking platform CertiK"

Wallet addresses from Tayvano:

0xf7e8033366166f92eb477b7b38e0d47d47b43326 0xb0146aec3593410c8307b570af69adf4d74678b3 0x940362b46faf7df48af1c8989d809f50466b5fca 0x1Dd7dAf089C16856155FeFd7e2170966bb6b3AEE

According to Cyvers, "Estimated losses have now exceeded $52M, with most of the stolen assets currently being swapped. Affected chains include #ETH, #BNB, #BASE, #OP, #POLYGON, #ARB, and #Avalanche."

"[Temporary Wallet Maintenance Notice]

Schedule: ~24 hours When maintenance is done, we will announce it through a notice.

We sincerely apologize for any inconvenience this may cause and appreciate your patience."

"At around 4am 20 Sep Singapore time, our technical team detected abnormal network access, suspecting a hacker attack on BingX's hot wallet. We immediately started our emergency plan, including the urgent transfer of assets and withdraw suspension. There has been minor asset loss, but the amount is small and still being calculated.

To protect user assets, we use a layered management system, with the majority of assets stored in cold wallets and only a minimal stored in hot wallets for withdrawals. To ensure security, withdrawals have been temporarily suspended while we conduct an emergency inspection and strengthen wallet services. We sincerely apologize for the inconvenience. Withdrawals will be restored within 24 hours at the latest.

BingX and the development team apologize for the disruption. Our mission to provide a seamless and trusted trading environment remains firm. We are working on a compensation plan, which will be announced soon. Thank you for your understanding and continued support."

"While the loss is still under calculation, we confirm the following:

1) BingX will fully compensate for the loss with our own capital.

2) The total loss is minimal and manageable. This incident will not affect our ongoing business operations. Trading services continue as usual. Withdrawals and deposits are temporarily delayed and are expected to be restored within 24 hours at the latest.

3) Users' assets are safe and well-protected under our layered asset management architecture.

Thank you for your understanding and continued support. We will keep you posted."

According to Cyvers, "Estimated losses have now exceeded $52M, with most of the stolen assets currently being swapped. Affected chains include #ETH, #BNB, #BASE, #OP, #POLYGON, #ARB, and #Avalanche."

"Our deposit and withdrawal services are gradually reopening. This incident has allowed us to feel an unprecedented level of trust and support from our users, project teams, and institutional partners.

Withdrawals were restored earlier than deposits because we fully understand the urgency users feel to protect their assets during uncertain times. The delay in reopening deposits was due to our need to ensure the wallet services were secure enough to avoid any further damage. During the first few hours, I was constantly monitoring the numbers. On the one hand, I worried about the system's capacity to handle a potential rush of withdrawals, but my greater concern was how we would rebuild our hard-earned brand image.

However, over the past 24 hours, both the number of users withdrawing and the amount withdrawn were far lower than expected. At this moment, our hearts are filled with gratitude. We deeply thank all our users and partner institutions for your trust!"

BingX is a large exchange which promote4s itself through a sponsorship of the Chelsea Football Club in Fulham, West London. The exchange boast "100% Proof-of-Reserves with top cybersecurity organizations as partners". On September 19th, 2024, the exchange found that their assets were rapidly draining from their hot wallets, confirming publicly roughly an hour after reports by multiple industry sources had noted the drainage. The exchange quickly promised to cover all user assets on the platform and over the course of the next week began enabling withdrawals again.

Rekt - BingX - Rekt (Sep 23)
@tayvano_ Twitter (Sep 23)
@BingXOfficial Twitter (Sep 23)
@Vivien_BingX Twitter (Sep 23)
@CyversAlerts Twitter (Sep 23)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 23)
https://bingx.com/en/ (Sep 23)
https://bingx.com/en/sponsorship/ (Sep 23)
- YouTube (Sep 23)
@Vivien_BingX Twitter (Sep 23)
Arkham (Sep 23)
Arkham (Sep 23)
@tayvano_ Twitter (Sep 23)
@peckshield Twitter (Sep 23)
SlowMist Hacked - SlowMist Zone (Sep 23)

More case studies

DIN Twitter Account
Breach Ransom Attempt

Shezmu Unbacked
Collateral Vulnerability