Compromised API Keys Cost Market Maker Kronos Research $26M, Rattle Partner Exchange Woo X

Taiwan-based trading firm Kronos Research lost $26 million over a weekend after attackers gained unauthorized access to a set of its API keys, triggering liquidity strain at closely associated exchange Woo X.

Kronos disclosed the breach as "unauthorized access of some of our API keys." A subsequent update confirmed the $26 million figure, stating that despite the size of the loss, "Kronos remains in good standing" and that "all losses will be covered internally, no partners will be affected."

Woo X said that Kronos was its largest liquidity provider, and that once Kronos's trading activity was halted following the hack, the exchange opted to pause its markets to "protect users positions from a lack of liquidity." The move drew visible frustration from users, who were not pleased to see a market maker's losses spill over into disrupted trading on a partner exchange — a dynamic that echoed prior episodes in the industry.

01How the funds moved

According to on-chain tracking by X-explore, Kronos Research accounts spanning four exchanges across both Ethereum and BNB Smart Chain began being drained starting at approximately 5PM UTC on Saturday.

Funds left OKX and BTSE directly to the attacker's address. From Binance and Deeocoin, however, the funds first passed through Kronos's own address before reaching the attacker — likely because withdrawal whitelist restrictions on those exchanges limited which addresses could receive funds directly.

The attacker's address has been identified as 0x2b0502FDab4e221dcD492c058255D2073d50A3ae. A full breakdown of the affected assets, exchanges, and chains was published as a flowchart by X-explore.

02Not Kronos's first incident

This was not the first time Kronos Research had suffered a loss. As reported back in August, two engineers, reportedly dissatisfied over an unpaid bonus, tampered with the quantitative trading team's code before departing the company, causing a $1.4 million loss.

Nor is this the first instance of API key leaks resulting in losses from centralized exchange accounts industry-wide, as seen in past incidents.

03A familiar structure

Observers pointed to the close relationship between Kronos and Woo X as one of the more notable aspects of the story. The firm had previously been described as resembling an Alameda/FTX/FTT-style arrangement, even as it maintained that the two entities were credibly separate. Given the parallels to the dynamics that defined the depths of the last bear market, some commentators questioned whether the industry was witnessing a version of the same pattern play out again.