Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/btcturkhotwalletnetworkattack.php}} {{Unattributed Sources}} BtcTurk Logo/HomepageBtcTurk is one of the largest exchanges in Turkey. On late June, they suffered a breach of 10 different hot wallets where funds were drained. It is estimated that $55m worth of funds were taken. They have promised to fully cover all losses and gradually been reopening withdrawals..."

2024-09-18T21:01:37Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/btcturkhotwalletnetworkattack.php}} {{Unattributed Sources}} thumb|BtcTurk Logo/HomepageBtcTurk is one of the largest exchanges in Turkey. On late June, they suffered a breach of 10 different hot wallets where funds were drained. It is estimated that $55m worth of funds were taken. They have promised to fully cover all losses and gradually been reopening withdrawals..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/btcturkhotwalletnetworkattack.php}}
{{Unattributed Sources}}

[[File:Btcturk.jpg|thumb|BtcTurk Logo/Homepage]]BtcTurk is one of the largest exchanges in Turkey. On late June, they suffered a breach of 10 different hot wallets where funds were drained. It is estimated that $55m worth of funds were taken. They have promised to fully cover all losses and gradually been reopening withdrawals of different wallets over time.<ref name="slowmisthackedarchive-14420" /><ref name="web3isgoinggreat-14436" /><ref name="x-14437" /><ref name="x-14438" /><ref name="x-14439" /><ref name="status-14440" /><ref name="btcturk-14441" /><ref name="statusarchive-14442" /><ref name="x-14443" /><ref name="aydinnyunusgithub-14444" />

== About BtcTurk ==
One of the largest Turkish exchanges.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - BtcTurk Hot Wallet Network Attack
!Date
!Event
!Description
|-
|June 22nd, 2024 5:17:00 AM MDT
|BtcTurk Status Update
|The BtcTurk website posts an initial announcement about the hack which is under investigation. Users are invited to check the status website.
|-
|June 22nd, 2024 6:12:00 AM MDT
|Wu Blockchain Report
|Wu Blockchain reports on the attack against the BtcTurk cryptocurrency exchange being reported. 10 hot wallet balances are reportedly affected.
|-
|June 22nd, 2024 6:59:00 AM MDT
|Avalanche Token Sale
|A large sale of 54 million USD of AVAX is reported. The AVAX at 0x32...4f30 originated from a Turkish exchange, which may be BtcTurk.
|-
|June 22nd, 2024 8:43:00 AM MDT
|Richard Teng Tweet
|Richard Teng, the new CEO of Binance, tweets that over $5.3m worth of the stolen funds have been frozen on Binance.
|-
|June 22nd, 2024 9:26:00 AM MDT
|Web3IsGoingGreat Post
|Web3IsGoingGreat shares the story on their Twitter account.
|-
|June 22nd, 2024 11:37:00 AM MDT
|Wallet Tracer Analysis
|An analysis through a wallet tracer program is available for where the funds went.
|-
|June 22nd, 2024 10:39:00 PM MDT
|Some Withdrawals Restored
|The BtcTurk platform announces that they have re-enabled the withrdrawals of USDT, USDC, LINK, UNI, OCEAN, AGIX, BLUR, INJ, ANT, OGN, RAD, ARPA.
|-
|June 22nd, 2024 11:06:00 PM MDT
|More Withdrawals Restored
|Deposits and withdrawals of all ERC20 cryptocurrencies from the ERC20 network have been enabled.
|-
|June 23rd, 2024 8:47:00 PM MDT
|Bitcoin Withdrawals Restored
|Your Bitcoin (BTC) deposit addresses have been renewed, and deposit and withdrawal operations are now open. Users are instructed to be sure they use new bitcoin addresses.
|-
|June 24th, 2024 4:01:00 PM MDT
|Avalanche Withdrawals Restored
|Your AVAX (C-Chain) and ARC-20 USDT deposit addresses have been renewed, and deposit and withdrawal operations are now open
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
$55m

The total amount lost has been estimated at $55,000,000 USD.

== Immediate Reactions ==
"The Turkish cryptocurrency exchange BtcTurk has acknowledged that they suffered a hack that impacted ten hot wallets containing multiple cryptocurrencies. The exchange halted deposits and withdrawals while investigating, and said they are working with law enforcement. It appears that assets notionally worth around $55 million were stolen. Furthermore, the exploiter sold substantial amounts of some cryptocurrencies, including Luna Classic, causing major price movements in those tokens."

"The Turkish cryptocurrency exchange BtcTurk has acknowledged that they suffered a hack that impacted ten hot wallets containing multiple cryptocurrencies. The exchange halted deposits and withdrawals while investigating, and said they are working with law enforcement."

"Under investigation - Dear valued user,
Our teams have determined that an unauthorized withdrawal incident occurred on our platform due to a cyber attack on June 22, 2024. Only a portion of the balances of 10 cryptocurrencies in hot wallets were affected by this cyber attack, while the majority of assets held in cold wallets remain secure.

BtcTurk's financial strength exceeds the amounts affected by this attack, and user assets will not be affected by these losses. Our teams are conducting detailed investigations into the matter and have also contacted the authorities. As a precaution, cryptocurrency deposits and withdrawals have been suspended, and they will be resumed once our investigations are complete at the earliest. You can track the current status of operations at https://status.btcturk.com."

== Ultimate Outcome ==
"It appears that assets notionally worth around $55 million were stolen. Furthermore, the exploiter sold substantial amounts of some cryptocurrencies, including Luna Classic, causing major price movements in those tokens.

According to newly installed Binance CEO Richard Teng, Binance froze $5.3 million of the stolen assets."

== Total Amount Recovered ==
All losses will be covered by the exchange.

The total amount recovered has been estimated at $55,000,000 USD.

== Ongoing Developments ==
"Binance is assisting BtcTurk with investigations and have frozen over $5.3M in stolen funds so far.

Our investigations & security teams work around the clock as part of our proactive efforts to protect the ecosystem from bad actors. We will provide further updates as relevant."

"Our efforts related to the cyber attack previously announced continue within the Company and in collaboration with relevant stakeholders. Deposits and withdrawals of the cryptocurrencies listed below on the ERC20 network have been enabled. Deposits and withdrawals of cryptocurrencies affected by the cyber attack will be gradually restored as our cybersecurity teams complete their detailed investigations. You can track the current status of operations at https://status.btcturk.com. USDT, USDC, LINK, UNI, OCEAN, AGIX, BLUR, INJ, ANT, OGN, RAD, ARPA"
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthackedarchive-14420">[https://web.archive.org/web/20240624184511/https://hacked.slowmist.io/ SlowMist Hacked - SlowMist Zone] (Accessed Jun 25, 2024)</ref>

<ref name="web3isgoinggreat-14436">[https://www.web3isgoinggreat.com/?id=btcturk-exploited-for-at-least-55-million BtcTurk exploited for at least $55 million] (Accessed Jun 26, 2024)</ref>

<ref name="x-14437">[https://x.com/_RichardTeng/status/1804525525614096511 x.com] (Accessed Jun 26, 2024)</ref>

<ref name="x-14438">[https://x.com/WuBlockchain/status/1804487593062752260 x.com] (Accessed Jun 26, 2024)</ref>

<ref name="x-14439">[https://x.com/WuBlockchain/status/1804499362611163646 x.com] (Accessed Jun 26, 2024)</ref>

<ref name="status-14440">[https://status.btcturk.com/ BtcTurk Status] (Accessed Jun 26, 2024)</ref>

<ref name="btcturk-14441">[https://btcturk.com/ BtcTurk - Finansal Hizmetler] (Accessed Jun 26, 2024)</ref>

<ref name="statusarchive-14442">[https://web.archive.org/web/20240525062801/https://status.btcturk.com/ BtcTurk Status] (Accessed Jun 26, 2024)</ref>

<ref name="x-14443">[https://x.com/aydinnyunuss/status/1804569477910032506 x.com] (Accessed Jun 26, 2024)</ref>

<ref name="aydinnyunusgithub-14444">[https://github.com/aydinnyunus/wallet-tracker GitHub - aydinnyunus/wallet-tracker: Detect real scammers with Wallet-Tracker CLI from anywhere.] (Accessed Jun 26, 2024)</ref></references>

BtcTurk Hot Wallet Network Attack - Revision history