BitoPro Multiple Hot Wallets Drained During System Upgrade

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

BitoPro Logo/Background

BitoPro is a Taiwan-based cryptocurrency exchange launched in 2018 by the BitoEX team, which has been active in the crypto space since 2014, offering services like digital wallets and financial auditing. Known for its user-friendly app and support for major cryptocurrencies such as BTC, ETH, and TRON, BitoPro serves over 138,000 traders and maintains a strong reputation for security and reliability. However, on May 8, 2025, the exchange was exploited for approximately $11.5 million during a wallet system upgrade, when attackers drained assets from hot wallets across Ethereum, Tron, Solana, and Polygon, then laundered the proceeds via DEXs, Tornado Cash, Thorchain, and Wasabi Wallet. While technical details of the exploit remain limited, BitoPro quickly responded by securing assets, blocking the attacker, and initiating an investigation with a third-party cybersecurity firm. The exchange confirmed that user funds were not impacted, core services continued uninterrupted, and further steps are being taken to improve transparency and security.

About BitoPro

BitoPro is a cryptocurrency exchange platform developed by the BitoEX team in response to growing demand in the digital asset space. BitoEX was founded in 2014 and initially focused on offering a range of cryptocurrency solutions, including digital wallets, business applications, and financial auditing. With a strong emphasis on customer service, branding, and accessibility, BitoEX aimed to simplify entry into the cryptocurrency world for both individuals and businesses. In early 2018, after years of groundwork and market analysis, the team launched BitoPro—an international digital asset exchange designed to offer fast, secure, and user-friendly crypto trading experiences.

Headquartered in Taiwan, BitoPro supports a variety of popular cryptocurrencies such as BTC, ETH, LTC, BITO, MITH, and TRON. It provides users with real-time price tracking, market depth visualization, and convenient crypto deposit functions through its dedicated mobile app. As of now, the exchange supports 16 coins and 26 trading pairs, with a 24-hour trading volume around 444 BTC. The platform uses a maker-taker fee model—charging 0.10% for makers and 0.20% for takers—and includes features like staking BITO tokens for fee discounts and a referral program. More than 138,000 traders use BitoPro, which holds a trust score of 8, indicating a high level of reliability and user trust (BitDegree).

Despite occasionally being referred to as decentralized, BitoPro operates as a centralized exchange under the management of BitoEX. The platform places a strong emphasis on security, offering two-factor authentication (2FA), cold storage of digital assets, and regular audits. While primarily serving the Taiwanese market with support for the New Taiwan Dollar (TWD), BitoPro is accessible to users internationally. The BitoEX team continues to focus on innovation and customer satisfaction, aiming to deliver fast, economical, and high-quality trading services to a growing global user base.

The Reality

It appears that BitoPro's hot wallets on multiple blockchains were compromised and significant quantities of funds were drained starting on May 8th.

What Happened

BitoPro was exploited for approximately $11.5 million when attackers drained old hot wallets across multiple blockchains during a system upgrade.

Key Event Timeline - BitoPro Multiple Hot Wallets Drained During System Upgrade

Date	Event	Description
May 8th, 2025 9:45:00 AM MDT	BitoPro Announces System Maintenance	BitoPro has a brief announcement of system maintenance, and emphasizes that all other functions such as trading and fiat deposit/withdrawal are functioning as normal.
May 8th, 2025 1:17:42 PM MDT	Tron Theft Of 247,975.794336 USDT	A transaction on the blockchain shows that 247,975.794336 USDT are being stolen on the Tron blockchain.
June 1st, 2025 10:04:00 PM MDT	BitoPro Posts Trading Competition	BitoPro posts a trading competition for their users on Twitter/X
June 1st, 2025 11:57:00 PM MDT	ZachXBT Exposes Breach Publicly	ZachXBT posts on Twitter/X to confront BitoPro, questioning the exchange about suspicious outflows of approximately $11.5 million from multiple hot wallets on May 8, 2025. He highlights the lack of transparency, pointing out that BitoPro has yet to disclose the security incident on X or Telegram, even several weeks after it occurred, raising serious concerns about their communication and handling of the situation.
June 2nd, 2025 3:15:00 AM MDT	BitoEx Official Statement	BitoEx releases an official statement addressing what they describe as a recent cyberattack on an old hot wallet during a system upgrade. The team responded immediately by securing assets in new wallets and blocking the attacker, while also engaging a third-party cybersecurity firm to investigate. BitoPro confirmed that user assets remain completely unaffected, and all platform functions continue to operate normally. To ensure transparency, the exchange promised they will soon disclose new hot wallet addresses, while most assets remain securely stored in offline cold wallets.

Technical Details

Limited technical details are available. The exchange has not disclosed the exact nature of the exploit, the method of attack, or any vulnerabilities that may have been exploited.

According to available information, that attack appears to have been a coordinated cyberattack during a wallet system upgrade. The breach affected hot wallets across multiple blockchains—including Ethereum, Tron, Solana, and Polygon—which saw suspicious outflows. The stolen assets were swiftly market-sold via decentralized exchanges (DEXs), and the proceeds were laundered through privacy-focused tools: routed to Tornado Cash, or bridged to Bitcoin via Thorchain and then funneled through Wasabi Wallet. BitoPro later confirmed the incident involved an old hot wallet and assured that user assets were not affected, emphasizing that their cold wallets remain secure.

ZachXBT provided theft addresses: 0x2453933c98b6e55397103f7c1081626e0a02d2c9 0x454cf3892a949c94569ab2663090ecdca811a6f0 TRoLEoNiiod5m8TSdmSR4iW17yQCfc2YJV G1bdPViZztqV5ptH3mVyXdAKYRm1jBhGiGvdDx9LmaCd bc1qcwzxklr3tr7zjhvql7pqtg57rkvm55vcz8ydul

Total Amount Lost

ZachXBT reports that the platform was "likely exploited for ~$11.5M on May 8, 2025." The breach affected hot wallets across multiple blockchains—including Ethereum, Tron, Solana, and Polygon—which saw suspicious outflows.

The total amount lost has been estimated at $11,500,000 USD.

Immediate Reactions

BitoPro initially reacted to the situation by temporarily disabling deposits and withdrawals and posting a system maintenance notification for users.

A translation of the original notice is as follows:

1. Important News #System Maintenance Announcement

[Temporary maintenance of virtual currency top-up/withdrawal]

• 11:45 Update: Wallet system vendors are still processing, and the

recovery time will be announced separately

Dear members:

Currently, the virtual currency top-up and withdrawal system is temporarily under maintenance, and will be announced separately later. We apologize for the inconvenience,

[Maintenance time] Recovery time will be announced separately [Affected ites] Virtual currency top-up and withdrawal functions [Service as usual] Taiwan dollar top-up/withdrawal, trading functions BitoPro Team

Ultimate Outcome

After being called out by ZachXBT, BitoPro provides an official announcement regarding what they referred to as a recent cyberattack targeting an old hot wallet during a wallet system upgrade. Upon detecting the breach, the BitoPro team immediately initiated emergency response protocols, successfully securing user funds by transferring assets to new wallets and swiftly blocking the attacker. In addition, a third-party cybersecurity firm has been engaged to assist with the investigation and trace any leads related to the incident.

The exchange assures users that BitoPro’s virtual asset reserves are strong and that user assets remain completely unaffected. All core platform functions—including deposits, withdrawals, and trading—have continued to operate without disruption since the incident.

In a move to reinforce its commitment to transparency and asset security, BitoPro will soon publicly disclose the addresses of its new hot wallets. It also reaffirmed that the majority of digital assets are held in highly secure offline cold wallets. BitoPro emphasized that it is continuously enhancing its security protocols and wallet management systems, thanking users for their ongoing support and trust as it works to uphold the highest standards of safety and service.

Total Amount Recovered

The platform reports having strong reserves, and is believed to be covering all losses on behalf of users.

The total amount recovered has been estimated at $11,500,000 USD.

Ongoing Developments

BitoPro has released limited details on the nature of the exploit. They appear to be continuing to work with authorities on a recovery.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.