Poloniex bled about $120M from its hot wallets in a single night

On November 10, 2023, the veteran U.S. exchange Poloniex began hemorrhaging funds as large, unexplained outflows drained its wallets. Estimates of the damage varied by firm: PeckShield cited about $125 million, SlowMist about $130 million and Beosin roughly $114 million, as reported by Recorded Future News (The Record).

Poloniex is owned by Justin Sun, the crypto entrepreneur who acquired it from Circle in 2020, The Record noted. PeckShield's breakdown put the stolen assets at about $56 million in ether, $48 million in Sun's own TRX token and $18 million in bitcoin.

A stolen key, not a broken contract

The incident bore the hallmarks of a compromised hot wallet — a private key leaked or otherwise stolen, letting the attacker sign withdrawals as though they were the exchange itself. It is the same failure mode that struck several platforms in 2023. U.S. law enforcement has long held that North Korea's Lazarus Group is a primary driver of such attacks, The Record reported, though no government agency has publicly pinned this specific theft on any group.

Sun said publicly that Poloniex would fully reimburse affected funds and that the losses were within manageable limits, per The Record. The exchange also offered the attacker a bounty worth 5% of the stolen amount to return the rest, asking for a response within seven days.

Within days, blockchain trackers watched the thief begin moving the stolen tokens, and Poloniex kept operating while pledging to make users whole, The Record reported. As with nearly every exchange breach, the funds moved faster than any freeze request could follow — a reminder that on public blockchains, speed favors the thief.

Protect yourself

• Do not use an exchange as a savings account. Balances you are not actively trading belong in a wallet whose keys you control.
• Spread your custody. Concentrating funds on one platform turns a single stolen key into a total loss.
• A public 'reimbursement' pledge is a promise, not a deposit. Judge a platform by its proof-of-reserves and history, not its crisis messaging.
• Bounty offers to hackers rarely make victims whole. They usually signal the money is already beyond easy recovery.

Poloniex's operators could absorb the hit; most users have no such cushion. The lesson is unchanged: a hot wallet is only as safe as the single key that guards it, and that key is exactly what professional attackers hunt.

— Sources: [The Record](https://therecord.media/poloniex-cryptocurrency-platform-millions-stolen)