# BitoPro Date:: 2025-05-09 Amount Stolen:: $12,300,000 Tags:: ⁉️ --- ## Details BitoPro Statement & Progress UpDate:: June 19, 2025 This statement provides an update on the security incident that occurred on May 9, 2025. Our internal security team and a third-party professional cybersecurity firm conducted a comprehensive, month-long investigation. Based on the forensic report issued on June 11, 2025, preliminary findings confirm no internal personnel involvement. Furthermore, the attack methodology bears resemblance to patterns observed in multiple past international major incidents, including illicit transfers from global bank SWIFT systems and asset theft incidents from major international cryptocurrency exchanges. These attacks are attributed to the North Korean hacking organization 'Lazarus Group.' The attackers conducted a social engineering attack on a team member responsible for cloud operations, successfully implanting malware. This allowed them to bypass our antivirus, endpoint protection, and cloud security detection systems. The threat actors then operated stealthily from the employee's computer, observing daily operational behaviors to evade routine security monitoring. They subsequently hijacked AWS Session Tokens to bypass Multi-Factor Authentication (MFA). From the AWS environment, they delivered commands via a C2 server to discreetly transfer malicious scripts to the hot wallet host, awaiting an opportunity to launch the attack. After prolonged observation, the hackers specifically targeted the platform during its wallet system upgrade and asset transfer period, simulating normal operational behaviors to launch the attack. At approximately 1:00 AM (UTM+8) on May 9, the malicious script was activated, simulating legitimate transactions, and illicitly transferred cryptocurrency from the hot wallet. Upon detecting abnormal wallet activity, our security team immediately initiated response mechanisms. These included: emergency shutdown of the hot wallet system, changing all associated cryptographic keys, isolating and rebuilding affected systems and terminal devices, expanding monitoring, and continuously tracking abnormal behaviors to prevent further hacker activity. The incident has now been handed over to criminal investigation units for ongoing investigation and forensic analysis. We re-examined and rebuilt our wallet system immediately. On May 19, we proactively provided our hot wallet addresses to the on-chain data tracking platform Arkham to update platform liquidity and related data. As of June 19, some wallet addresses on their page (https://intel.arkm.com/explorer/entity/bitopro) have been updated, and users can review them. This security incident once again highlights the continuous evolution of cyberattack methodologies. This is not only a challenge for virtual asset platforms but also a crucial issue that Taiwanese financial institutions, and indeed all industries, should prioritize. We deeply understand that information security is an unending test. Moving forward, BitoPro will continue to strengthen our security technologies and management processes, and actively exchange experiences. We urge the industry to heighten vigilance, working together to build a secure and stable trading environment in a rapidly changing digital world. ## Further Reading - https://t.me/BitoProOfficial/165602 - https://x.com/bitoex_official/status/1935594731393909017 - https://www.facebook.com/BitoGroup/posts/pfbid02SgsySubD6Df1ngQnavsaWHQGnJv3WhBtBWodVC5rXGFVCBkTeGsHw5jmHf8VooWkl - https://www.bitopro.com/ns/en-US/announcements/1226 - Attributed in [MSMT: The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities](./pdfs/2025-10-22_MSMT-Report.pdf) ## Onchain - 0x2453933c98b6e55397103f7c1081626e0a02d2c9 - Theft - 0x454cf3892a949c94569ab2663090ecdca811a6f0 - Theft - bc1qcwzxklr3tr7zjhvql7pqtg57rkvm55vcz8ydul - Theft - G1bdPViZztqV5ptH3mVyXdAKYRm1jBhGiGvdDx9LmaCd - Theft - TRoLEoNiiod5m8TSdmSR4iW17yQCfc2YJV - Theft - 0xc545dd3fc70fa4358d761ba22a59e88e8a01c742 - Victim? $600k o2meta.io?