BtcTurk Halts Crypto Transfers After Hot-Wallet Breach

BtcTurk disclosed on June 22, 2024 that a cyberattack had produced unauthorized withdrawals from its cryptocurrency platform, forcing the Turkish exchange to suspend crypto deposits and withdrawals while it investigated the breach.

The company said portions of the balances held in hot wallets for 10 cryptocurrencies were affected. It said the cold wallets holding the large majority of its assets remained secure and asserted that its financial resources exceeded the amount exposed, so customer assets would not absorb the losses. Those statements established the scope BtcTurk was prepared to confirm on June 22; they did not establish the attack method, the complete asset list or a final loss.

An operational breach, not a protocol failure

Hot wallets are internet-connected systems exchanges use to process routine deposits and withdrawals. Their availability makes them operationally useful but exposes them to risks that do not apply in the same way to offline cold storage. BtcTurk’s disclosure therefore pointed to a failure within the exchange’s custody perimeter, not a demonstrated defect in Bitcoin, Avalanche or another affected blockchain.

The distinction mattered because exchange breaches can generate superficially blockchain-like evidence—large transfers, swaps and cross-chain movements—without showing how the attacker first obtained control. On June 22, BtcTurk had not published a technical post-mortem identifying compromised credentials, private keys, internal systems or software vulnerabilities. Any specific account of the entry mechanism would consequently have exceeded the verified record.

BtcTurk said it contacted official authorities and began a detailed investigation. Suspending transfers was a containment measure: it reduced the possibility of additional unauthorized withdrawals while the exchange examined wallets and rebuilt transaction controls. Trading and custody claims still depended on BtcTurk’s own internal accounting, which outside observers could not independently audit from the announcement alone.

Binance freezes part of the disputed flow

Richard Teng, then Binance’s chief executive, said on June 22 that Binance was assisting BtcTurk and had frozen more than $5.3 million in stolen funds. The figure was a direct statement from the operator that imposed the freeze, but it was not a measurement of BtcTurk’s total loss. Nor did a freeze mean the assets had already been returned: it indicated that Binance had restricted movement of funds it associated with the incident while investigations continued.

Contemporaneous blockchain researchers separately associated an address moving 1.96 million AVAX, then estimated at $54.2 million, with the breach. That attribution was an analyst’s hypothesis based on address and timing analysis, not a loss figure confirmed by BtcTurk. The exchange did not disclose a total on June 22, so estimates around $54 million or €51 million remained unverified rather than settled facts.

Why the incident mattered

The breach demonstrated both sides of centralized crypto custody. A connected wallet system created a concentrated point of failure, while cooperation between exchanges created a mechanism for interrupting the movement of suspected stolen assets. Public blockchains can make transfers observable, but attribution, freezing and restitution still depend on investigators, custodians and legal process.

For BtcTurk customers, the immediate verified development was operational: crypto deposits and withdrawals were suspended, a subset of hot-wallet balances had been affected, and the exchange said customer losses would be covered. The unresolved questions were more consequential than the early estimates—how access was obtained, which assets were taken, the final loss after freezes, and whether the exchange’s assurances would be borne out once services and reconciliations were completed.