What Happened?
On May 8, Taiwan’s cryptocurrency exchange BitoPro encountered a hacker attack during a system upgrade and asset transfer of its hot wallets, resulting in approximately $11.5 million worth of cryptocurrency being stolen. On-chain detective ZachXBT revealed that the hacker utilized techniques such as dumping assets on decentralized exchanges, mixing services, and cross-chain operations to launder the stolen funds, publicly disclosing multiple suspicious hacker wallet addresses.
Initially, BitoPro suspended services citing “system maintenance” without providing further explanation, which led to widespread skepticism from ZachXBT and the market. BitoPro issued a statement today confirming the hacker attack, emphasizing that it had immediately activated its response mechanism, successfully thwarting the hacker’s actions and transferring assets to a new wallet.
BitoPro stated in its announcement that to demonstrate its commitment to asset security and information transparency, it will soon publicly disclose the new hot wallet address for external verification and reaffirmed that the vast majority of assets are stored in unaffected cold wallets. Additionally, BitoPro committed to continuously enhancing its cybersecurity measures, improving wallet management processes and monitoring capabilities to ensure user asset safety.
BitoPro Exchange Hacked? Hacker Laundering Techniques Exposed: Rapid Transfers and Mixing Operations
Recently, Taiwan’s cryptocurrency exchange BitoPro has been embroiled in cybersecurity concerns. Well-known on-chain detective ZachXBT posted a message in a Telegram group on May 8, 2025, indicating that BitoPro appears to have suffered a hacker attack, with approximately $11.5 million worth of cryptocurrency stolen from its hot wallets.
Several weeks have passed since the incident, and BitoPro has only cited “system maintenance” as a reason for suspending services, drawing significant market attention and skepticism.
ZachXBT pointed out that the attacker transferred assets from multiple hot wallets of BitoPro, involving blockchains such as Tron, Ethereum, Solana, and Polygon. After stealing the assets, the hacker swiftly employed a series of complex laundering techniques and attempted to sever connections to the source of the funds.
First, the stolen assets were rapidly dumped through decentralized exchanges (DEX), then transferred to mixing services like Tornado Cash for obfuscation. Some funds were even routed through Thorchain for cross-chain operations, ultimately flowing into more privacy-focused Wasabi wallets, complicating tracking efforts.
ZachXBT also publicly disclosed several suspicious wallet addresses believed to belong to the hacker (the assets have been emptied), including:
- Ethereum Address: 0x2453933c98b6e55397103f7c1081626e0a02d2c9
- Ethereum Address: 0x454cf3892a949c94569ab2663090ecdca811a6f0
- Tron Address: TRoLEoNiiod5m8TSdmSR4iW17yQCfc2YJV
- Solana Address: G1bdPViZztqV5ptH3mVyXdAKYRjN1jBhGiGvdDx9LmaCd
- Bitcoin Address: bc1qcwzxklr3tr7zjhvql7pqtg57rkvm55vcz8ydul
What Does BitoPro Say?
Despite the major cybersecurity incident, since May 8, BitoPro has only suspended cryptocurrency deposit and withdrawal services citing “system maintenance.” ZachXBT has commented on a post made by BitoPro on X (formerly Twitter), publicly questioning why the exchange has not disclosed the security incident regarding the suspicious outflows of approximately $11.5 million several weeks later.
Do you want to explain to the community why multiple of your hot wallets saw suspicious outflows of ~$11.5M on May 8, 2025 where you still have not disclosed the security incident on X or Telegram several weeks later?
pic.twitter.com/HlD0c93Or4— ZachXBT (@zachxbt) June 2, 2025
BitoPro also issued an official statement today (June 2), confirming that its old hot wallets were indeed attacked during the system upgrade and asset transfer process.
BitoPro stated that upon the occurrence of the incident, it immediately activated an emergency response mechanism, swiftly transferring platform assets to a new wallet and successfully blocking the hacker’s actions, while commissioning a third-party professional cybersecurity firm to assist in investigating and tracking relevant clues.
BitoPro emphasized that the platform’s virtual asset reserves are sufficient, and user rights are completely unaffected. Since the incident occurred, user functions for top-ups, withdrawals, and transactions have been maintained normally.
To uphold its highest commitment to asset security and information transparency, BitoPro also pledged to publicly disclose the new hot wallet address for external verification in the coming days and reiterated that the vast majority of the platform’s assets are stored long-term in cold wallets with no external connections, remaining unaffected, ensuring overall asset security. In the future, BitoPro will continue to strengthen its cybersecurity measures, enhance wallet management processes, and monitoring capabilities to protect user assets with the highest standards.