HTX hot wallet loses 4,999 ETH in Sunday breach

A successful Ethereum transaction at 10:00:47 UTC on September 24, 2023 moved exactly 4,999 ETH from an address that Etherscan identifies as “HTX 38” to an address it later labeled “HTX Global Hacker 1.” The transfer became the clearest fixed record of a breach at the centralized exchange formerly known as Huobi.

HTX adviser Justin Sun publicly confirmed the attack on September 25, not on September 24. He rounded the loss to 5,000 ETH and $8 million, said HTX had covered it, and asserted that the platform continued to operate normally. Those operational and balance-sheet assurances were company claims; the public Ethereum ledger verifies the transfer, but it cannot prove whether customers were made whole.

What the ledger establishes

Transaction 0xe9eefff04322a1e9262aad139e7b03954709a7c2ffea5ba9d1026a24fb58c029 settled successfully in Ethereum block 18,204,925. It sent 4,999 ETH from 0x2Abc…feB6A to 0xdb1D…AEC83. Etherscan records the timestamp, amount and addresses, while its entity labels are off-chain annotations that may be added or revised after the fact.

One minute later, at 10:01:35 UTC, the receiving address sent 1,001 ETH to a second address later tagged as another HTX hacker wallet. That rapid split was consistent with efforts to separate the balance, although the transactions alone do not establish who controlled either destination or how access to the originating wallet was obtained.

For a contemporaneous dollar reference, Etherscan stores an ether price of $1,580.82 with the first transaction. Multiplying that figure by 4,999 gives $7,902,519.18, consistent with the approximately $7.9 million reported by blockchain-security researchers on September 25. This is a reconstruction from one explorer’s historical price field, not an executable market quote. Etherscan does not identify the venue or sampling window for that field, and the live dollar total displayed on the transaction page changes with the current ETH price.

Why the incident mattered

The event was principally a custody and exchange-security story, not a protocol failure. Ethereum processed a valid, signed value transfer. The unresolved question on September 24 was how an unauthorized party, if that characterization was correct, obtained the ability to direct funds from an exchange-controlled hot wallet.

That distinction mattered because customers of a centralized venue depend on the operator’s key management, withdrawal controls and balance sheet. They cannot independently reverse a valid Ethereum transfer. Sun’s promise that HTX would absorb the loss therefore addressed solvency and customer confidence, but it was not an independently audited proof of reserves or liabilities.

Timing sharpened the reputational impact. Huobi had announced its HTX rebrand on September 13, eleven days before the transfer. A security incident so close to that relaunch put operational controls ahead of branding: the amount was small relative to Sun’s claimed $3 billion of user assets, but that comparison was also unaudited and supplied by the exchange’s adviser.

What was knowable on September 24

The immutable facts available from the chain were a 4,999 ETH transfer out of the wallet now attributed to HTX and the subsequent 1,001 ETH split. Public confirmation, the $8 million characterization and assurances about user balances arrived on September 25. Accordingly, this reconstruction dates the event to the on-chain movement without pretending the full explanation was public on September 24.

Later context

On October 7, the destination wallets returned nearly all of the transferred ether, and HTX paid a 250 ETH bounty. A return message attributed the incident to a hot-wallet private-key leak, but that later claim was made by the wallet controller and does not independently establish the original compromise method.