Hong Kong Crypto Exchange Bilaxy Hacked for $450 Million

Hong Kong-based cryptocurrency trading platform Bilaxy has suffered a serious attack that resulted in the loss of several hundred ERC-20 tokens on its hot wallet. It’s estimated that the exchange lost about US$450 million, though Bilaxy is yet to confirm the total amount of digital assets lost to the attacker. 

Users are advised not to send any funds to their Bilaxy accounts until further notice. 

What Happened to Bilaxy?

In its official telegram channel, the Bilaxy team said they noticed the abnormal transactions from their ERC-20 hot wallet (online wallet) around 18:19 UTC on August 29. Some minutes later, they halted all services for emergency maintenance and also moved some of the tokens from the hot wallet to the cold wallet.

This was confirmed to be a security breach, and about 295 ERC-20 tokens had already been moved from the Bilaxy hot wallet to a single wallet controlled by the hacker. Hoge Finance disclosed that about one billion HOGE was stolen from the exchange, equivalent to US$145,000 at the time of writing. 

In the meantime, Bilaxy says while it’s working with third-party security and audit companies to investigate the attack, all services will remain suspended. “The time it will take to resume the platform depends on the progress of our work, [but] it will take at least two weeks or longer,” the Bilaxy team tweeted on August 30.

Crypto Exchange Attacks Are Rising

The rate of cyber attacks in the crypto space is becoming alarming. Also in August, Poly Network was drained of about US$600 million in digital assets, although the hacker has since returned all the stolen assets. 

Most recently, Japanese cryptocurrency exchange Liquid Global lost nearly US$100 million worth of cryptocurrencies in an attack that involved a hot wallet – basically any cryptocurrency wallet that functions online or requires an internet connection. Although more convenient to use, they are also more prone to attacks than cold wallets.