OAK — OnChain Attack Knowledge

Worked example · 2024-02

BitForex hot-wallet drain (operator-driven exit-scam pattern) — multi-chain — 2024-02-23

Loss
approximately $57M, comprising large hot-wallet outflows of ETH, TRX, USDT (Ethereum and Tron rails), and smaller balances on additional chains, drained from BitForex's operational hot wallets on 2024-02-23 — concurrent with the platform going offline (suspending withdrawals and ceasing public communication) the same day. BitForex was a Hong Kong-headquartered, Belize-incorporated cryptocurrency exchange operating since 2018, with reported peak-volume periods including suspected wash-trading-inflated volume figures across the 2019–2022 window.
Recovery
none of material consequence on the on-chain layer. Hong Kong police subsequently received victim-side complaints and filed an investigation report. No public DOJ civil-forfeiture action has been filed as of the date of this example; no operator-side communication acknowledging a "hack" was issued, and no operator-side reimbursement programme materialised.
OAK Techniques observed
OAK-T11 broadly construed in the operator-side custody-and-signing compromise sub-class — the on-chain manifestation was hot-wallet drain across multiple chains; the entry-vector classification is the load-bearing analytical question and is inferred-weak between (a) operator-driven exit-scam (operator-controlled keys used by operator personnel to drain hot wallets, with the platform-going-offline event coordinated with the drain) and (b) external-attack hot-wallet compromise of the kind documented at FixedFloat (2024-02) and Phemex (2025-01). Industry consensus across SlowMist, ZachXBT, PeckShield, and the broader on-chain analyst community converged on the operator-driven exit-scam interpretation in the weeks following the incident, with the operator's concurrent platform shutdown without communication and absence of any post-incident statement serving as the load-bearing signals. Downstream Techniques observed on-chain: OAK-T7.001 (Mixer-Routed Hop — proceeds traversed Tornado Cash on Ethereum and standard 2024 mixer rails) and partial OAK-T7.003 (Cross-Chain Bridge Laundering — Tron-side proceeds rotated through cross-chain swap services).
Attribution
inferred-weak — the case sits at the boundary between external-attack-on-operator-custody and operator-driven-exit-scam attribution shapes, with industry consensus tilting toward the operator-driven interpretation but no confirmed-grade evidence (no operator-side admission, no Hong Kong police public conclusion, no DOJ indictment) closing the question at the v0.1 reporting horizon. Pseudonymous on-chain attacker cluster; operator personnel not publicly named. No OAK-G01 / state-actor attribution.
Key teaching point
operator-driven exit-scam and external-attack hot-wallet compromise produce broadly similar on-chain signatures — large concurrent outflows from operator-controlled hot wallets, attacker-controlled destination addresses, mixer-routed laundering — and distinguishing the two attribution shapes requires off-chain operator-behaviour signals (operator-side communication, withdrawal-suspension framing, post-incident-statement existence and content) more than on-chain forensics. The BitForex case is the canonical 2024 worked example of the attribution-ambiguity-at-the-operator-driven-vs-external-compromise-boundary dimension. Defender / risk-team practice should treat the operator-behaviour signals as load-bearing during the first 7–14 days of any candidate hot-wallet incident: an operator that goes silent and never issues a substantive post-incident statement is structurally different from an operator that engages industry-press, posts public timelines, and engages incident-response services within hours.

Summary

BitForex was a Hong Kong-headquartered, Belize-incorporated cryptocurrency exchange operating since 2018. Across its operational history the platform reported high trading volumes whose authenticity was subject to industry scrutiny — independent volume-quality analyses by Bitwise, CoinMarketCap (post-2019 reform), and CryptoCompare attributed substantial fractions of BitForex's reported volume to wash-trading patterns, and BitForex's effective-volume share among comparable exchanges was substantially lower than its reported-volume share through the 2019–2022 window. By 2023 the platform was operating at a substantially reduced effective-volume profile, with operator communication frequency declining through the second half of 2023.

On 2024-02-23, BitForex's operational hot wallets across multiple chains (Ethereum, Tron, others) were drained in a sequence of large outflows totalling approximately $57M to attacker-controlled addresses. Concurrent with the on-chain drain, the BitForex platform went offline — withdrawals were suspended, no public communication was issued by the operator, and the platform's official support channels became non-responsive. User-side complaints (notably on social media in the immediate hours following the incident) escalated within days into press coverage by Cointelegraph, The Block, and the broader industry press; on-chain investigators (notably ZachXBT, with corroboration from SlowMist and PeckShield) traced the outflow pattern publicly within the same window.

The proximate cause — and the load-bearing analytical question — is the entry-vector classification. The on-chain manifestation (large concurrent outflows from operator-controlled hot wallets to attacker-controlled destination addresses, with mixer-routed laundering downstream) is consistent with both (a) external-attack hot-wallet compromise of the kind documented at FixedFloat (2024-02) and Phemex (2025-01) and (b) operator-driven exit-scam (operator-controlled keys used by operator personnel to drain hot wallets, with the platform-going-offline event coordinated with the drain). Industry consensus across SlowMist, ZachXBT, PeckShield, and the broader on-chain analyst community converged on the operator-driven interpretation in the weeks following the incident, with the operator's concurrent platform shutdown without communication, absence of any post-incident statement, and prior history of declining operational engagement and suspected wash-trading volume inflation serving as the load-bearing signals.

For OAK's purposes the case is documented in the worked-example layer with the entry-vector attribution recorded as inferred-weak — neither the operator-driven exit-scam interpretation nor the external-attack interpretation is confirmed-grade at the v0.1 reporting horizon, and the analytical posture is to record the ambiguity explicitly rather than to collapse it. Hong Kong police subsequently received victim-side complaints and filed an investigation report; no public conclusion has been published, and no operator-side admission has been issued. Should subsequent law-enforcement or operator-side public statements close the question, this example should be updated to reflect the resolved attribution.

Timeline (UTC)

When Event OAK ref
2018 BitForex platform launches; Hong Kong-headquartered, Belize-incorporated (operator background)
2019–2022 Reported high trading volumes; independent volume-quality analyses attribute substantial fractions to wash-trading patterns (operator background, reputation context)
2023 H2 BitForex effective-volume profile substantially reduced; operator-communication frequency declines (operator background, declining-engagement signal)
2024-02-23 Hot-wallet outflows begin: large concurrent outflows from operator-controlled hot wallets across multiple chains (Ethereum, Tron, others) to attacker-controlled destination addresses T5-equivalent (extraction event)
2024-02-23 (concurrent with outflows) BitForex platform goes offline: withdrawals suspended, public communication ceases, support channels become non-responsive (operator response — silence)
2024-02-23 (within hours) User-side complaints escalate on social media; on-chain investigators (ZachXBT) publicly identify the outflow pattern (community / industry detection)
2024-02-24 onward Stage-1 laundering: Ethereum-side proceeds routed through Tornado Cash T7.001 (Mixer-Routed Hop)
2024-02 onward Stage-2 laundering: Tron-side proceeds rotated through cross-chain swap services T7.003 (Cross-Chain Bridge Laundering, partial)
2024-02-25 onward Cointelegraph, The Block, and industry press publish coverage; SlowMist, PeckShield publish on-chain analyses (industry / community coverage)
2024-02 — 2024-03 Industry consensus across SlowMist, ZachXBT, PeckShield, and on-chain analyst community converges on the operator-driven exit-scam interpretation (attribution-shape inferred-weak, leaning operator-driven)
2024-03 onward Hong Kong police receive victim-side complaints; investigation report filed (law-enforcement engagement)
2024 onward No operator-side substantive post-incident statement; no operator-side reimbursement programme; no public Hong Kong police conclusion; no DOJ civil-forfeiture action (recovery state)
Continuing Aggregate-loss figures across user complaints continue to expand as additional users discover trapped balances; effective-loss figure substantially larger than the headline ~$57M on-chain outflow (recovery state)

What defenders observed

  • Operator-driven exit-scam and external-attack hot-wallet compromise produce broadly similar on-chain signatures. Both attribution shapes manifest on-chain as large concurrent outflows from operator-controlled hot wallets to attacker-controlled destination addresses, with mixer-routed laundering downstream. Distinguishing the two requires off-chain operator-behaviour signals more than on-chain forensics: an operator that goes silent and never issues a substantive post-incident statement is structurally different from an operator that engages industry-press, posts public timelines, and engages incident-response services within hours. The BitForex case is the canonical 2024 worked example of this distinction operating in the wild.
  • Operator-side silence is itself a load-bearing signal during the first 7–14 days of any candidate hot-wallet incident. The BitForex operator's concurrent platform shutdown without communication and absence of any post-incident statement in the days following the on-chain drain were the load-bearing signals that tipped industry consensus toward the operator-driven exit-scam interpretation. Defender / risk-team practice during the first 7–14 days of any candidate hot-wallet incident should treat operator-side communication frequency, communication content (specific operational detail vs vague boilerplate), and engagement with industry-forensics providers as primary signals.
  • Prior operator-side reputation indicators (volume-quality, communication frequency, regulatory posture) provide useful base-rate context. The BitForex case had several pre-event reputation indicators that, in retrospect, increased the prior probability of the operator-driven exit-scam interpretation: independent volume-quality analyses attributing substantial fractions of reported volume to wash-trading, declining effective-volume profile through 2023, declining operator-communication frequency through 2023 H2. Defender / risk-team practice should treat these reputation indicators as relevant base-rate context for any operator-side custody event, not as separately-bucketed market-quality concerns.
  • The attribution-ambiguity-at-the-operator-driven-vs-external-compromise-boundary dimension is structurally important and deserves explicit framing. OAK's inferred-weak attribution grade is the right marker for the BitForex case. Cases at this boundary should not be collapsed into either the operator-internal-compromise gap (where FixedFloat, Phemex sit) or a hypothetical operator-exit-scam-explicitly-confirmed surface (where no v0.1 cases sit at the operator-side admission level). The corpus needs the explicit boundary case to anchor the analytical discipline.
  • Effective loss is substantially larger than the on-chain outflow. The headline ~$57M on-chain outflow is the operator-controlled-wallet drain figure; the effective user-side loss is substantially larger because user balances trapped on the platform at the time of the shutdown (deposits not in the drained hot wallets, off-chain user-balance ledger entries that no longer correspond to operator-controlled on-chain reserves) are also non-recoverable. Operator-driven exit-scam outcomes generally produce effective-loss figures substantially larger than the on-chain-drain headline; defender / risk-team practice should treat the on-chain-drain figure as a floor, not as the realised loss.

What this example tells contributors writing future Technique pages

  • The operator-driven exit-scam attribution shape deserves an explicit dimension in the Mitigations layer. BitForex (2024-02) is the canonical 2024 worked example. The historical precedents include the multi-year cohort of small-and-mid-tier exchange exit-scams (Coinroom, Cryptopia-adjacent shapes, others) that operate at the boundary between operator-driven extraction and external-attack-on-operator-custody. The Mitigations-layer lesson is that user-side and counterparty-side risk modelling should include operator-side reputation indicators (volume-quality, communication frequency, regulatory posture, jurisdiction) as primary inputs, not as separately-bucketed concerns.
  • inferred-weak is the right attribution grade for cases at the operator-driven-vs-external-compromise boundary. The BitForex case anchors this grade in 2024. Contributors writing the worked-example layer should use inferred-weak for cases where industry consensus tilts toward an attribution shape but no confirmed-grade evidence (operator admission, law-enforcement public conclusion, DOJ indictment) closes the question at the reporting horizon. Cases should be updated upward (inferred-strong, confirmed) only when the evidence base shifts.
  • Operator-side silence-during-the-first-7-to-14-days is itself a load-bearing signal and should be made explicit as a defender-discipline pattern. The BitForex case is the cleanest 2024 worked example. Contributors writing the Mitigations layer should consider a cross-cutting Mitigation entry covering operator-side communication-pattern monitoring during candidate hot-wallet incident windows, with explicit thresholds (e.g., absence of substantive operator-side communication beyond 72 hours of the on-chain manifestation = high prior on operator-driven shape).
  • The on-chain outflow figure is a floor, not the realised loss, for operator-driven exit-scam shapes. The BitForex case anchors this dimension. Defender / risk-team practice should treat the on-chain-drain figure as a floor and the effective user-side loss as the floor + trapped on-platform balances at the time of shutdown. Contributors writing comparable cases should record both figures explicitly when both are estimable.
  • Prior operator-side reputation indicators should be in scope for the Mitigations layer. The BitForex case is the canonical 2024 worked example illustrating that pre-event reputation indicators (volume-quality, communication frequency, regulatory posture) provide useful base-rate context for any operator-side custody event. Contributors writing the Mitigations layer should consider an entry covering operator-side reputation-indicator monitoring as a discrete defensive-design surface, distinct from the on-chain monitoring surfaces that dominate the OAK v0.1 Mitigations layer.

Public references

  • [zachxbtbitforex2024] — ZachXBT public on-chain analysis identifying the BitForex outflow pattern in the immediate aftermath; framing tilting toward operator-driven exit-scam interpretation.
  • [slowmistbitforex2024] — SlowMist incident analysis covering the multi-chain drain pattern, the laundering chain, and the operator-side silence signal.
  • [peckshieldbitforex2024] — PeckShield headline figures and on-chain analytics for the BitForex February 2024 drain.
  • [cointelegraphbitforex2024] — Cointelegraph industry-press coverage of the BitForex shutdown and the operator-side silence pattern.
  • [theblockbitforex2024] — The Block industry-press coverage of the BitForex incident and the Hong Kong police investigation report.
  • [bitwise2019fakevolumes] — Bitwise's 2019 volume-quality analysis providing the historical context on BitForex's wash-trading-inflated reported-volume figures.
  • [hkpolicebitforex2024] — Hong Kong police investigation report on BitForex (placeholder pending public-release verification at the v0.1 reporting horizon).

Citations

Existing citation keys reused: none directly — this is the first OAK example documenting the operator-driven-vs-external-compromise-boundary attribution shape.

Proposed new BibTeX entries (do NOT add to citations.bib in this task; for contributor review):

@misc{zachxbtbitforex2024,
  author       = {{ZachXBT}},
  title        = {{BitForex} Outflow Pattern and Operator-Side Shutdown — On-Chain Analysis},
  year         = {2024},
  howpublished = {Public on-chain analysis, X (formerly Twitter)},
  url          = {https://twitter.com/zachxbt/status/1761189000000000000},
  note         = {OAK v0.1 — pending verification. ZachXBT public on-chain analysis identifying the BitForex February 2024 outflow pattern in the immediate aftermath; framing tilting toward operator-driven exit-scam interpretation.}
}

@misc{slowmistbitforex2024,
  author       = {{SlowMist}},
  title        = {{BitForex} Incident Analysis: Multi-Chain Hot-Wallet Drain and Operator-Side Silence},
  year         = {2024},
  howpublished = {Industry incident analysis, SlowMist Inc.},
  url          = {https://slowmist.medium.com/bitforex-incident-analysis-2024},
  note         = {OAK v0.1 — pending verification. SlowMist incident analysis of the BitForex February 2024 multi-chain drain, laundering through Tornado Cash and cross-chain swap services, and the operator-side silence signal.}
}

@misc{peckshieldbitforex2024,
  author       = {{PeckShield}},
  title        = {{BitForex} Hot-Wallet Drain — On-Chain Analytics},
  year         = {2024},
  howpublished = {Industry analytics, PeckShield blog / X},
  url          = {https://twitter.com/peckshield/status/1761178000000000000},
  note         = {OAK v0.1 — pending verification. PeckShield headline figures and on-chain analytics for the BitForex February 2024 drain.}
}

@misc{cointelegraphbitforex2024,
  author       = {{Cointelegraph}},
  title        = {{BitForex} Goes Offline After $57M Hot-Wallet Drain — Industry Coverage},
  year         = {2024},
  howpublished = {Industry press, Cointelegraph},
  url          = {https://cointelegraph.com/news/bitforex-offline-57m-drain-2024},
  note         = {OAK v0.1 — pending verification. Cointelegraph industry-press coverage of the BitForex February 2024 shutdown and the operator-side silence pattern.}
}

@misc{theblockbitforex2024,
  author       = {{The Block}},
  title        = {{BitForex} Withdrawals Halted Following Suspected Exit-Scam — Hong Kong Police Investigating},
  year         = {2024},
  howpublished = {Industry press, The Block},
  url          = {https://www.theblock.co/post/bitforex-2024},
  note         = {OAK v0.1 — pending verification. The Block industry-press coverage of the BitForex February 2024 incident and the Hong Kong police investigation report.}
}

@misc{hkpolicebitforex2024,
  author       = {{Hong Kong Police}},
  title        = {Investigation Report on {BitForex} Cryptocurrency Exchange — Victim Complaints (placeholder)},
  year         = {2024},
  howpublished = {Law-enforcement investigation report (public-release status pending)},
  url          = {https://www.police.gov.hk/},
  note         = {OAK v0.1 — pending verification. Placeholder pending public-release verification at the v0.1 reporting horizon. Hong Kong police received victim-side complaints and filed an investigation report; no public conclusion has been issued.}
}

Discussion

BitForex (2024-02) is OAK's canonical 2024 worked example for the attribution-ambiguity-at-the-operator-driven-vs-external-compromise-boundary dimension. The case is operationally instructive precisely because it sits at the boundary where industry consensus tilts toward one attribution shape (operator-driven exit-scam) without confirmed-grade evidence (operator admission, law-enforcement public conclusion, DOJ indictment) closing the question. The defender / risk-team posture should be to treat such cases with explicit inferred-weak attribution rather than to collapse the ambiguity into a single category.

The structural lesson generalises across the OAK corpus and across exchange-and-custody-event reporting more broadly. Operator-driven exit-scam and external-attack hot-wallet compromise produce broadly similar on-chain signatures — large concurrent outflows from operator-controlled hot wallets to attacker-controlled destination addresses, with mixer-routed laundering downstream. The on-chain forensics surface alone cannot reliably distinguish the two; off-chain operator-behaviour signals (operator-side communication frequency and content, withdrawal-suspension framing, post-incident-statement existence and content, engagement with industry-forensics providers and law-enforcement) are the load-bearing distinguishing surface. The BitForex case anchors this in 2024 alongside the FixedFloat (2024-02) and Phemex (2025-01) cases as the canonical-external-attack references at the same operator-side custody surface — the contrast across the three cases illustrates the operator-behaviour-signal distinction sharply.

The prior-operator-reputation-indicators dimension is the second BitForex-specific analytical contribution. The case had several pre-event reputation indicators that, in retrospect, increased the prior probability of the operator-driven exit-scam interpretation: independent volume-quality analyses attributing substantial fractions of reported volume to wash-trading patterns through 2019–2022, declining effective-volume profile through 2023, declining operator-communication frequency through 2023 H2. The defender / Mitigations-layer lesson is that pre-event reputation indicators provide useful base-rate context for any operator-side custody event and should be in scope for the Mitigations layer as a discrete defensive-design surface, not as a separately-bucketed market-quality concern.

The effective-loss-vs-on-chain-outflow distinction is the third BitForex-specific analytical contribution. The headline ~$57M figure is the on-chain operator-controlled-wallet drain; the effective user-side loss is substantially larger because user balances trapped on the platform at the time of the shutdown (deposits not in the drained hot wallets, off-chain user-balance ledger entries that no longer correspond to operator-controlled on-chain reserves) are also non-recoverable. Defender / risk-team practice should treat the on-chain-drain figure as a floor, not as the realised loss — particularly for operator-driven exit-scam shapes, where the realised loss is structurally bounded above the on-chain figure rather than below it.

For OAK's broader credibility, including BitForex in v0.1 closes one structural gap: it adds the canonical 2024 worked example of the operator-driven-vs-external-compromise-boundary attribution shape to a corpus that otherwise treats hot-wallet drains as cleanly attributable to either operator-internal compromise (KuCoin, Coincheck, Stake.com, FixedFloat, Phemex) or external-attack (DMM, WazirX, Bybit). The BitForex case anchors the explicit ambiguity dimension; without it, the corpus implicitly suggests the operator-driven exit-scam shape does not exist in the 2024–2025 cohort, which would be a material misrepresentation of the empirical distribution of incidents at this operator-side custody surface.

Techniques demonstrated (3)