Story highlights
- Four former HTX employees were sentenced for implanting Trojans in wallets, and stealing over 40,000 user mnemonics and private keys.
- Chinese police investigations reveal a major security breach in HTX wallets, leading to arrests and three-year prison sentences.
- HTX responds to major security breaches by cooperating with authorities, emphasizing the need for robust crypto security measures.
Former HTX Employees Sentenced for Major Cryptocurrency Theft
Chinese police have revealed that four former employees of HTX (formerly Huobi) implanted Trojans in cryptocurrency wallets, stealing over 40,000 user mnemonics and private keys. These individuals have been sentenced to three years in prison, though the specific amount of stolen cryptocurrencies remains undisclosed.
In May 2023, citizen Ou discovered his virtual currency, worth millions of RMB, had disappeared. Investigating further, Ou identified a backdoor program in his wallet software that automatically obtained wallet addresses and private keys.
Arrest and Confession
Ou reported the incident to the Xuhui Public Security Bureau in August 2023, leading to the arrest of former HTX employees Zhang, Dong, and Liu. They confessed to adding a backdoor program in early March 2023 to steal users’ private keys. Liu wrote the program, Dong purchased the server and domain name, and Zhang set up the server and database.
Execution of the Plan
The backdoor was activated five days after installation, uploading private keys, mnemonics, and other data to a designated database. The trio destroyed the server and database at the end of May 2023, planning to use the stolen keys to access virtual currencies two years later. However, they were arrested three months later.
Legal Proceedings and Sentencing
The investigation revealed that the trio had not yet used the stolen data to transfer virtual currencies, including Ou’s. They had collected over 27,000 mnemonics and more than 10,000 private keys, converting more than 19,000 digital wallet addresses. The Xuhui District People’s ambassador charged them with illegally obtaining computer information system data. In April 2024, Xuhui District People’s Court sentenced Liu, Zhang, and Dong to three years in prison and fined them RMB 30,000 each.
Further investigation led to the arrest of another former HTX employee, Zhang Yi. He had embedded a similar backdoor in the virtual wallet software of another platform in July 2021. Facing financial pressure, Zhang Yi used Ou’s stolen private key in April 2023 to transfer all his virtual currency and convert it to other digital assets.
Zhang Yi’s Sentence
Zhang Yi had illegally obtained more than 6,400 user private keys and mnemonics. Following his confession and partial compensation to Ou, Zhang Yi was sentenced to three years in prison and fined RMB 50,000 by the Xuhui District People’s Court in April 2024 for illegally obtaining computer information system data.
Response from HTX
According to Wu, Blockchain Company A is suspected to be the original Huobi Company. In 2023, Wu reported that former employees set up Trojans that leaked mnemonics or private keys of some users of iToken (the original Huobi wallet). HTX stated that it cooperated with the Shanghai Public Security Bureau to conduct investigations and gather evidence.
Rising Crypto Hacks
Crypto losses from hacks and scams more than doubled in Q2 2024, totaling over $572 million compared to $220 million in Q2 2023, reports Immunefi. Centralized exchange hacks were the primary contributors. The largest loss was the $305 million Bitcoin theft from DMM on May 31, followed by the $55 million BtcTurk hack on June 22.
The recent arrest of former employees from a major cryptocurrency exchange underscores the escalating security risks in the digital currency industry. This event has flashed renewed discussions about the vulnerabilities in cryptocurrency exchanges and the measures needed to prevent such breaches. Authorities sentenced the offenders following an in-depth investigation, highlighting the need for stringent security protocols in crypto platforms.
Conclusion
Chinese police apprehend ex-employees of a top cryptocurrency exchange for hacking 40,000 accounts, spotlighting investor risk and the importance of robust security measures.
Join MEXC and Start Trading Today!
