Justin Sun's HECO Bridge and HTX Hot Wallets Drained of Roughly $99M in Same-Day Attacks

Two blockchain projects tied to Justin Sun were exploited within hours of one another, for combined losses of roughly $99 million. The Ethereum-side bridge for HECO (Huobi ECO Chain) lost $86.6 million, while hot wallets belonging to HTX (formerly Huobi) lost a further $12.5 million.

The breach landed just twelve days after Poloniex, another Sun-linked exchange, lost $126 million across the Ethereum, Tron and Bitcoin networks. HTX itself had already been drained of $8 million in late September, with those funds recovered roughly two weeks later. The timing was pointed: the day before this latest incident, crypto's attention — including Sun's — had been fixed on CZ and Binance's settlement with US authorities, part of a wider regulatory reckoning bearing down on the industry's biggest names.

Alerts of unusual fund movement surfaced first on HECO, then on HTX. Roughly two hours later, Sun confirmed both attacks and pledged to cover HTX's losses in full, writing: "HTX and Heco Cross-Chain Bridge Undergo Hacker Attack. HTX Will Fully Compensate for HTX's hot wallet Losses. Deposits and Withdrawals Temporarily Suspended. All Funds in HTX Are Secure, and the Community Can Rest Assured. We are investigating the specific reasons for the hacker attack. Once we complete the investigation and identify the cause, we will resume services."

On the HECO side, attackers took control of an operator account and used it, starting at 09:59 UTC, to withdraw assets from the bridge contract into an address under their control. Most of the stolen funds were then moved on to a separate accumulation wallet.

The HTX breach followed a comparable pattern through different infrastructure. Compromised hot wallets — including one holding ETH — began sending funds directly to attacker-controlled addresses starting at 10:41 UTC, split between one address that received ETH and another that took other assets.

Neither team has disclosed the precise root cause, but Peckshield suggested that, given the operational ties between the two platforms, a vulnerability exploited in earlier incidents may simply have been reused.

Peckshield's tally put the HECO bridge losses at $86.6 million across roughly 42 million USDT, more than 10,000 ETH (about $19 million), 489 HBTC (about $18.8 million), 347 million SHIB (about $2.8 million), 173,000 UNI (about $930,000), 619,000 USDC, 42,000 LINK (about $600,000), and 347,000 TUSD. Cyvers put the HTX loss at $12.5 million: 1,240 ETH (about $2.5 million), 7.3 million USDT, 1.78 million USDC, and 62,200 LINK (about $870,000). Security firm Hacken later published a list tracking the further movement of the stolen funds.

Analysts pointed to the operational signature of North Korea's Lazarus Group, which is estimated to have laundered more than half a billion dollars over the preceding six months, as consistent with this kind of dual exchange-and-bridge hit. One researcher noted that incomplete remediation after an initial compromise tends to leave the door open for follow-up attacks.

Whoever carried out the hack, the losses pile more pressure on Sun, who may be next in line for scrutiny from US regulators. HECO and HTX now mark the third and fourth security failures tied to Sun-affiliated projects inside three months, bringing the running total to roughly $233 million lost — of which only about $8 million has so far been returned. Earlier reporting on the Poloniex breach had already asked how deep Sun's reserves go; this latest pair of incidents leaves that question no closer to an answer.