Azoundria at 01:11, 24 September 2024

2024-09-24T01:11:37Z

← Older revision		Revision as of 19:11, 23 September 2024
Line 2:		Line 2:
	{{Unattributed Sources}}		{{Unattributed Sources}}

	[[File:Bingxcom.jpg\|thumb\|BingX Logo/Homepage]]BingX is a large exchange which promote4s itself through a sponsorship of the Chelsea Football Club in Fulham, West London. The exchange boast "100% Proof-of-Reserves with top cybersecurity organizations as partners". On September 19th, 2024, the exchange found that their assets were rapidly draining from their hot wallets, confirming publicly roughly an hour after reports by multiple industry sources had noted the drainage. The exchange quickly promised to cover all user assets on the platform and over the course of the next week began enabling withdrawals again.<ref name="rektnews-15691" /><ref name="tayvanotwitter-15692" /><ref name="bingxofficialtwitter-15693" /><ref name="vivienbingxtwitter-15694" /><ref name="cyversalertstwitter-15695" /><ref name="etherscan-15696" /><ref name="bingx-15697" /><ref name="bingx-15698" /><ref name="youtube-15699" /><ref name="vivienbingxtwitter-15700" /><ref name="platform-15701" /><ref name="platform-15702" /><ref name="tayvanotwitter-15703" /><ref name="peckshieldtwitter-15704" />		[[File:Bingxcom.jpg\|thumb\|BingX Logo/Homepage]]BingX is a large exchange which promote4s itself through a sponsorship of the Chelsea Football Club in Fulham, West London. The exchange boast "100% Proof-of-Reserves with top cybersecurity organizations as partners". On September 19th, 2024, the exchange found that their assets were rapidly draining from their hot wallets, confirming publicly roughly an hour after reports by multiple industry sources had noted the drainage. The exchange quickly promised to cover all user assets on the platform and over the course of the next week began enabling withdrawals again.<ref name="rektnews-15691" /><ref name="tayvanotwitter-15692" /><ref name="bingxofficialtwitter-15693" /><ref name="vivienbingxtwitter-15694" /><ref name="cyversalertstwitter-15695" /><ref name="etherscan-15696" /><ref name="bingx-15697" /><ref name="bingx-15698" /><ref name="youtube-15699" /><ref name="vivienbingxtwitter-15700" /><ref name="platform-15701" /><ref name="platform-15702" /><ref name="tayvanotwitter-15703" /><ref name="peckshieldtwitter-15704" /><ref name="slowmisthackedarchive-15705" />

	== About BingX ==		== About BingX ==
Line 169:		Line 169:
	<ref name="tayvanotwitter-15703">[https://twitter.com/tayvano_/status/1837134871593918806 @tayvano_ Twitter] (Accessed Sep 23, 2024)</ref>		<ref name="tayvanotwitter-15703">[https://twitter.com/tayvano_/status/1837134871593918806 @tayvano_ Twitter] (Accessed Sep 23, 2024)</ref>

	<ref name="peckshieldtwitter-15704">[https://twitter.com/peckshield/status/1836927530449916132 @peckshield Twitter] (Accessed Sep 23, 2024)</ref></references>		<ref name="peckshieldtwitter-15704">[https://twitter.com/peckshield/status/1836927530449916132 @peckshield Twitter] (Accessed Sep 23, 2024)</ref>

			<ref name="slowmisthackedarchive-15705">[https://web.archive.org/web/20240923201958/https://hacked.slowmist.io/ SlowMist Hacked - SlowMist Zone] (Accessed Sep 23, 2024)</ref></references>

Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/bingxmassivehotwalletbreach.php}} {{Unattributed Sources}} BingX Logo/HomepageBingX is a large exchange which promote4s itself through a sponsorship of the Chelsea Football Club in Fulham, West London. The exchange boast "100% Proof-of-Reserves with top cybersecurity organizations as partners". On September 19th, 2024, the exchange found that their assets wer..."

2024-09-23T20:18:09Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/bingxmassivehotwalletbreach.php}} {{Unattributed Sources}} thumb|BingX Logo/HomepageBingX is a large exchange which promote4s itself through a sponsorship of the Chelsea Football Club in Fulham, West London. The exchange boast "100% Proof-of-Reserves with top cybersecurity organizations as partners". On September 19th, 2024, the exchange found that their assets wer..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/bingxmassivehotwalletbreach.php}}
{{Unattributed Sources}}

[[File:Bingxcom.jpg|thumb|BingX Logo/Homepage]]BingX is a large exchange which promote4s itself through a sponsorship of the Chelsea Football Club in Fulham, West London. The exchange boast "100% Proof-of-Reserves with top cybersecurity organizations as partners". On September 19th, 2024, the exchange found that their assets were rapidly draining from their hot wallets, confirming publicly roughly an hour after reports by multiple industry sources had noted the drainage. The exchange quickly promised to cover all user assets on the platform and over the course of the next week began enabling withdrawals again.<ref name="rektnews-15691" /><ref name="tayvanotwitter-15692" /><ref name="bingxofficialtwitter-15693" /><ref name="vivienbingxtwitter-15694" /><ref name="cyversalertstwitter-15695" /><ref name="etherscan-15696" /><ref name="bingx-15697" /><ref name="bingx-15698" /><ref name="youtube-15699" /><ref name="vivienbingxtwitter-15700" /><ref name="platform-15701" /><ref name="platform-15702" /><ref name="tayvanotwitter-15703" /><ref name="peckshieldtwitter-15704" />

== About BingX ==
"Founded in 2018, BingX is a leading crypto exchange offering spot, derivatives, copy trading, and asset management. Experience a trustworthy platform that empowers you with innovative tools to elevate your trading game."

"BingX" "OFFICIAL CRYPTO EXCHANGE PARTNER OF CHELSEA FC"

"A global digital services financial institution with branch offices in Canada, the EU, and Australia Regulated business and services in countries where it operates"

"Robust identity verification, compliance and Know Your Customer (KYC) with Sumsub as a partner
Auto-detection of cybercrime-related risks with advanced AI technology"

"100% Proof-of-Reserves with top cybersecurity organizations as partners
Security audit approved by the leading security-focused ranking platform CertiK"

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
On September 19th, BingX learned a costly lesson in the dangers of hot wallet management and the persistence of sophisticated hacking groups.
{| class="wikitable"
|+Key Event Timeline - BingX Massive Hot Wallet Breach
!Date
!Event
!Description
|-
|September 19th, 2024 4:05:23 PM MDT
|USDC Withdrawal Transaction
|The first withdrawal transaction transfers 32.5k worth of USDC.
|-
|September 19th, 2024 4:09:11 PM MDT
|Ethereum Withdrawal Transaction
|Blockchain transaction transfers 13.394989549463115896 ETH to the first exploiter address.
|-
|September 19th, 2024 6:11:00 PM MDT
|Tayvano Tweet
|Tayvano tweets some of the addresses involved in the attack, starting a thread where further information will be posted.
|-
|September 19th, 2024 6:37:00 PM MDT
|PeckShield Tweet
|PeckShield tweets to notify BingX that they want to notice since they are observing significant outflows of funds from the exchange.
|-
|September 19th, 2024 7:20:00 PM MDT
|Temporary Maintenance Mode
|BingX announces that their wallets have been placed in a temporary maintenance mode.
|-
|September 19th, 2024 8:47:00 PM MDT
|Vivien Announces Full Compensation
|Vivien Lin announces that "BingX will fully compensate for the loss with our own capital" and calls the loss "minimal and manageable". "Withdrawals and deposits are temporarily delayed and are expected to be restored within 24 hours at the latest."
|-
|September 19th, 2024 11:44:00 PM MDT
|Cyvers Loss Estimation
|According to Cyvers, "Estimated losses have now exceeded $52M, with most of the stolen assets currently being swapped. Affected chains include #ETH, #BNB, #BASE, #OP, #POLYGON, #ARB, and #Avalanche."
|-
|September 20th, 2024 3:43:00 AM MDT
|Blacklist Policy Support
|Vivien Lin discusses the exchange's support of blacklisting known attack addresses and calls for the industry to come together to secure against known bad actors who are moving illicit funds.
|-
|September 20th, 2024 8:21:00 AM MDT
|Swapping Is Completed
|Tayvano announces that the attackers appear to be finally done swapping their cryptocurrency. She provides a summary screenshot with the time of the wallet movements, and an analysis of the breaks which the attacking team has taken.
|-
|September 23rd, 2024 3:42:00 AM MDT
|Withdrawals Reopening
|Main chain withdrawals are reopened for Tron, BSC, and ETH chains. Other chains and smaller altcoins will be reopened gradually.
|}

== Technical Details ==
Wallet addresses from Tayvano:

0xf7e8033366166f92eb477b7b38e0d47d47b43326
0xb0146aec3593410c8307b570af69adf4d74678b3
0x940362b46faf7df48af1c8989d809f50466b5fca
0x1Dd7dAf089C16856155FeFd7e2170966bb6b3AEE

== Total Amount Lost ==
According to Cyvers, "Estimated losses have now exceeded $52M, with most of the stolen assets currently being swapped. Affected chains include #ETH, #BNB, #BASE, #OP, #POLYGON, #ARB, and #Avalanche."

The total amount lost has been estimated at $44,061,000 USD.

== Immediate Reactions ==
"[Temporary Wallet Maintenance Notice]

Schedule: ~24 hours
When maintenance is done, we will announce it through a notice.

We sincerely apologize for any inconvenience this may cause and appreciate your patience."

"At around 4am 20 Sep Singapore time, our technical team detected abnormal network access, suspecting a hacker attack on BingX's hot wallet. We immediately started our emergency plan, including the urgent transfer of assets and withdraw suspension. There has been minor asset loss, but the amount is small and still being calculated.

To protect user assets, we use a layered management system, with the majority of assets stored in cold wallets and only a minimal stored in hot wallets for withdrawals. To ensure security, withdrawals have been temporarily suspended while we conduct an emergency inspection and strengthen wallet services. We sincerely apologize for the inconvenience. Withdrawals will be restored within 24 hours at the latest.

BingX and the development team apologize for the disruption. Our mission to provide a seamless and trusted trading environment remains firm. We are working on a compensation plan, which will be announced soon. Thank you for your understanding and continued support."

"While the loss is still under calculation, we confirm the following:

1) BingX will fully compensate for the loss with our own capital.

2) The total loss is minimal and manageable. This incident will not affect our ongoing business operations. Trading services continue as usual. Withdrawals and deposits are temporarily delayed and are expected to be restored within 24 hours at the latest.

3) Users' assets are safe and well-protected under our layered asset management architecture.

Thank you for your understanding and continued support. We will keep you posted."

According to Cyvers, "Estimated losses have now exceeded $52M, with most of the stolen assets currently being swapped. Affected chains include #ETH, #BNB, #BASE, #OP, #POLYGON, #ARB, and #Avalanche."

== Ultimate Outcome ==
"Our deposit and withdrawal services are gradually reopening. This incident has allowed us to feel an unprecedented level of trust and support from our users, project teams, and institutional partners.

Withdrawals were restored earlier than deposits because we fully understand the urgency users feel to protect their assets during uncertain times. The delay in reopening deposits was due to our need to ensure the wallet services were secure enough to avoid any further damage. During the first few hours, I was constantly monitoring the numbers. On the one hand, I worried about the system's capacity to handle a potential rush of withdrawals, but my greater concern was how we would rebuild our hard-earned brand image.

However, over the past 24 hours, both the number of users withdrawing and the amount withdrawn were far lower than expected. At this moment, our hearts are filled with gratitude. We deeply thank all our users and partner institutions for your trust!"

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-15691">[https://rekt.news/bingx-rekt/ Rekt - BingX - Rekt] (Accessed Sep 23, 2024)</ref>

<ref name="tayvanotwitter-15692">[https://twitter.com/tayvano_/status/1836921036367089967 @tayvano_ Twitter] (Accessed Sep 23, 2024)</ref>

<ref name="bingxofficialtwitter-15693">[https://twitter.com/BingXOfficial/status/1836938477570773470 @BingXOfficial Twitter] (Accessed Sep 23, 2024)</ref>

<ref name="vivienbingxtwitter-15694">[https://twitter.com/Vivien_BingX/status/1837064960192696400 @Vivien_BingX Twitter] (Accessed Sep 23, 2024)</ref>

<ref name="cyversalertstwitter-15695">[https://twitter.com/CyversAlerts/status/1837004902049927248 @CyversAlerts Twitter] (Accessed Sep 23, 2024)</ref>

<ref name="etherscan-15696">[https://etherscan.io/tx/0x984ed9470be5c72f37bc87bc1dc9f9525857e005f9d8b7cafdd6a54ca150af4b Ethereum Transaction Hash (Txhash) Details | Etherscan] (Accessed Sep 23, 2024)</ref>

<ref name="bingx-15697">[https://bingx.com/en/ https://bingx.com/en/] (Accessed Sep 23, 2024)</ref>

<ref name="bingx-15698">[https://bingx.com/en/sponsorship/ https://bingx.com/en/sponsorship/] (Accessed Sep 23, 2024)</ref>

<ref name="youtube-15699">[https://www.youtube.com/watch?v=6Xk9kVy0-ZA - YouTube] (Accessed Sep 23, 2024)</ref>

<ref name="vivienbingxtwitter-15700">[https://twitter.com/Vivien_BingX/status/1838151983620055551 @Vivien_BingX Twitter] (Accessed Sep 23, 2024)</ref>

<ref name="platform-15701">[https://platform.arkhamintelligence.com/explorer/entity/a4518f6f-9083-44c4-a4fc-f0cce558e09e Arkham] (Accessed Sep 23, 2024)</ref>

<ref name="platform-15702">[https://platform.arkhamintelligence.com/explorer/tx/0xfc1bcc3f2c1e134904625990f1fedbbd21fb55f2da80495d81a43ed208badc89 Arkham] (Accessed Sep 23, 2024)</ref>

<ref name="tayvanotwitter-15703">[https://twitter.com/tayvano_/status/1837134871593918806 @tayvano_ Twitter] (Accessed Sep 23, 2024)</ref>

<ref name="peckshieldtwitter-15704">[https://twitter.com/peckshield/status/1836927530449916132 @peckshield Twitter] (Accessed Sep 23, 2024)</ref></references>

BingX Massive Hot Wallet Breach - Revision history

Azoundria at 01:11, 24 September 2024