HTX hot wallet + HECO Bridge — Ethereum ↔ HECO — 2023-11-22

Summary

On November 22, 2023, two adjacent breaches against the HTX (formerly Huobi) ecosystem extracted approximately $110M+ in aggregate. The HTX hot wallet was drained of approximately $30M across multiple chains and assets; within roughly 24 hours, the HECO Bridge — the cross-chain bridge connecting HECO (Huobi Eco Chain) to Ethereum — was drained of approximately $87M. Both HTX and the HECO Bridge are operated under the broader Justin-Sun-aligned operator ecosystem that absorbed Huobi's brand and infrastructure during 2022–2023.

The HTX hot-wallet breach is a custody-surface compromise — a classic exchange hot-wallet drain whose specific entry vector (workstation compromise, signing-infrastructure compromise, insider-credentialed access) is not publicly detailed at confirmed-attribution strength. OAK catalogues this side under T11 broadly construed, with the sub-Technique under-specified pending further public disclosure.

The HECO Bridge breach is more clearly a T10.001 case. The bridge's outbound-transfer authorisation function was reached by parties not the legitimate operator; the on-chain transactions were cryptographically valid threshold-authorised transfers from the bridge's perspective. This is the same shape as Ronin (March 2022) and Harmony Horizon (June 2022) — adversarial control of the signer set, not a smart-contract vulnerability. Per [chainalysisdprktradertraitor] and SlowMist's contemporaneous analysis, the laundering pattern (DEX-swaps to ETH, cross-chain hops via Tron / TRC-20 USDT, structured deposits into mixing infrastructure) closely mirrored the established G01 playbook documented across the 2022 bridge wave and the 2023 Atomic Wallet / Stake.com cases. Match Systems and other industry trackers reached the same conclusion within days.

For OAK's purposes the load-bearing observation is the pair shape: G01 hit two adjacent surfaces of the same operator ecosystem inside a single operational episode. The implication for defenders running co-located exchange + bridge infrastructure is that the two surfaces share a credential, infrastructure, and personnel perimeter, and treating them as independent risk surfaces underestimates the blast radius of any single G01 entry vector.

Timeline (UTC)

When	Event	OAK ref
Pre-event (off-chain)	Compromise of HTX / HECO operational infrastructure giving access to hot-wallet signing authority and bridge-signer authority; specific entry vector not publicly detailed at confirmed-attribution strength (consistent with the LinkedIn / IT-recruiter playbook documented for G01 across 2022–2023)	(off-chain entry vector — out of OAK on-chain Tactic scope; documented under OAK-G01)
2023-11-22 (early UTC window)	HTX hot-wallet outflows totalling ~$30M observed across multiple chains; multiple addresses drained in rapid sequence	T11 extraction (HTX side)
2023-11-22 (within ~24 hours)	HECO Bridge outflows from the bridge's MPC-/multisig-controlled addresses totalling ~$87M; assets routed to attacker-controlled addresses on Ethereum	T10.001 extraction (HECO Bridge side)
2023-11-22 to 2023-11-23	Justin Sun publicly acknowledges the incident; states user funds will be made whole from operator reserves; initial industry forensic analyses (Chainalysis, SlowMist, Match Systems) begin tracing	(public response)
2023-11-23 onward	Industry forensic providers converge on G01 attribution on the basis of laundering-pattern overlap with prior 2022–2023 G01 cases and wallet-cluster reuse	G01 inferred-strong attribution
2023-11-23 onward	Stolen assets swapped to ETH on DEXes; cross-chain hops via Tron / TRC-20 USDT; structured deposits into mixing infrastructure consistent with the post-Tornado-Cash G01 playbook	T7-class laundering
Subsequent	No FBI / Treasury / DOJ public statement upgrading attribution to confirmed at v0.1 cutoff; industry consensus remains at inferred-strong for the G01 attribution	(attribution status)

What defenders observed

• Pre-event (off-chain): the entry vector for both surfaces is not publicly detailed at the level needed to instrument a defender-side detection. Industry consensus is consistent with the LinkedIn / IT-recruiter / fake-job-offer playbook documented across G01 cases since 2020, but no specific intrusion artefact for HTX / HECO has been published. The pre-event signal was, again, off-chain — and as with prior G01 cases, an operator running an exchange of HTX's scale should have treated G01 targeting as a baseline assumption rather than an exceptional event.
• Pre-event (on-chain, structural): the HECO Bridge's signer-set configuration was on the public record. Operators reading the bridge's authorisation surface as a third-party defender could enumerate the signing addresses and observe their balance / activity history, which is the third-party-readable structural-risk signal for any T10.001-class bridge. The HTX hot-wallet aggregation pattern (large balances on a small number of operationally-active addresses) was likewise readable on-chain and is the analogous structural signal for the T11 side.
• At-event: both extractions on-chain look like authorised operator actions. The HTX hot-wallet drain is a series of legitimate-looking outbound transfers from the operator's signing authority; the HECO Bridge drain is a series of cryptographically valid threshold-authorised transfers from the bridge's authorisation function. As with all T10.001 + T11 cases, the on-chain manifestation does not produce a protocol-violation signal at the contract layer; the detection signal lives in anomaly-against-baseline (size, destination clustering, off-hours timing) and in operator-side internal telemetry.
• Post-event (laundering): the laundering pattern was the load-bearing attribution surface. Within days, Chainalysis, SlowMist, and Match Systems independently traced the proceeds through DEX-swap-to-ETH, cross-chain hops via Tron / TRC-20 USDT, and structured deposits into mixing infrastructure — a near-exact replay of the G01 laundering playbook documented across the 2022 bridge wave (Ronin, Harmony Horizon) and the 2023 cases (Atomic Wallet, Stake.com, CoinEx, Alphapo). The pattern overlap is what carries the inferred-strong attribution.
• Pair shape: the cross-incident-pair-within-24-hours observation is the structural takeaway from the public record. No prior public-record G01 case had hit two adjacent surfaces of the same operator ecosystem in the same operational episode this cleanly. Defenders running co-located exchange + bridge infrastructure should treat this as the canonical instance of "single intrusion, two extraction surfaces."

What this example tells contributors writing future Technique pages

• Cross-Technique pair incidents are real and should be catalogued as such. HTX + HECO is not two unrelated incidents that happened to share a calendar week; it is one operational episode against one operator ecosystem with two extraction surfaces. Future contributors should resist the urge to write these as two independent worked examples on two separate Technique pages — the cross-Technique-pair shape is itself the load-bearing observation, and a single worked example linked from both the T11 and T10.001 Technique pages preserves it.
• Inferred-strong attribution from forensic-provider convergence is a stable category. This case sits at inferred-strong: three industry forensic providers (Chainalysis, SlowMist, Match Systems) independently converged on G01 on the basis of laundering-pattern overlap and wallet-cluster reuse, and no regulator has upgraded the attribution to confirmed as of v0.1 cutoff. Contributors should not promote this to confirmed in absence of a regulator / law-enforcement public statement, but should also not demote it to inferred-weak — the convergence-of-independent-providers pattern is materially stronger than single-provider speculation.
• Co-located exchange + bridge infrastructure shares a perimeter. The structural lesson generalises beyond HTX. Any operator running both an exchange (T11 surface) and a bridge (T10.001 surface) under shared credentials, infrastructure, or signing personnel should treat them as a single risk perimeter for attribution and detection purposes. The HTX + HECO pair is the canonical illustration; future contributors writing about other operator ecosystems with similar topology (e.g., exchange-affiliated bridges, exchange-backed L2s with custodial bridges) should reach for this case as the comparison reference.
• Detection latency was good, attribution latency was good, recovery latency is the open question. Unlike Ronin (six-day visibility gap) or Harmony Horizon (~7-month latency to FBI confirmation), the HTX / HECO case had both rapid detection (hours) and rapid inferred-strong attribution (days). The case is therefore not a useful illustration of detection-latency or attribution-latency lessons; its primary teaching value is the cross-Technique pair shape and the operator-side operational coupling between the two surfaces.

Public references

• [chainalysisdprktradertraitor] — Chainalysis forensic-tracing reference for the post-TraderTraitor / G01 laundering playbook; standing OAK reference for G01-attributed laundering shapes.
• [chainalysis2024dprk] — broader DPRK-attributed scale and Lazarus operational continuity; cross-references the November 2023 HTX / HECO event in the 2023 incident catalogue.
• [slowmistheco2023] (proposed) — SlowMist contemporaneous forensic analysis of the HTX hot-wallet drain and HECO Bridge breach (November 2023); primary same-week industry-side write-up converging on G01 attribution.
• [matchsystemsheco2023] (proposed) — Match Systems contemporaneous on-chain tracking and attribution analysis of the HTX + HECO incident pair.
• [justinsuhtxstatement2023] (proposed) — Justin Sun public statement (X / Twitter and HTX official channels) acknowledging the November 2023 incident and committing to make user funds whole from operator reserves.

Discussion

HTX + HECO is OAK's canonical cross-Technique-pair worked example. The structural observation — that a single G01 operational episode can hit two adjacent surfaces of one operator ecosystem inside a 24-hour window — does not generalise to a new Technique on its own (the per-surface Techniques T11 and T10.001 are unchanged), but it generalises directly to a defender-side framing question that OAK contributors should preserve when writing future cases: does the operator ecosystem under analysis run multiple extraction surfaces under shared credentials / infrastructure / personnel, and if so, how does that compress the threat model?

The case is also notable for what it does not establish. It does not establish a new Technique class. It does not establish a new G01 sub-cluster. It does not establish a new laundering pattern — the post-event laundering followed the documented G01 playbook closely enough that it served as the attribution evidence rather than as a novel observation in its own right. The case's value is structural and operational, not taxonomic; contributors should resist the temptation to over-extract from it.

A reasonable open question for future iterations is whether OAK should explicitly catalogue operator-ecosystem-pair incidents as a recognised structural category alongside per-incident worked examples, with HTX + HECO as the v0.1 anchor. The argument for: the cross-Technique-pair shape is increasingly common as operator ecosystems consolidate exchange + bridge + custody under unified infrastructure, and a defender reading the worked-example library benefits from a named pattern. The argument against: cataloguing structural categories at the worked-example layer risks under-using the Technique pages themselves, which are where structural lessons should propagate. The v0.1 decision is to keep the cross-Technique-pair framing in the per-example Discussion sections (here and in any subsequent pair cases) rather than promote it to a framework axis.

Contributors writing future operator-ecosystem-pair cases should:

• Document both surfaces in a single worked example linked from both Technique pages, not in two separate worked examples.
• Preserve the within-window timing (hours / days, not weeks) as the load-bearing structural feature; pair shapes that span weeks or months are operationally distinct from same-episode pairs.
• Mark the attribution at the strongest single tier supportable by the public record at the time of writing (here, inferred-strong); upgrade with a date-stamped note if and when a regulator / law-enforcement public statement lands.