Poloniex hack
About $120M+ was drained from hot wallets of the Justin Sun-owned exchange Poloniex on November 10, 2023, across Ethereum, Tron, and Bitcoin. Security firms attributed it to a private-key compromise, with the North Korea-linked Lazarus Group widely suspected.
Also known as: Poloniex, Poloniex hack
Summary
On November 10, 2023, hot wallets belonging to Poloniex — a long-running exchange owned by Tron founder Justin Sun — were drained across the Ethereum, Tron, and Bitcoin networks. Estimates ranged from about $114 million to $132 million. [1][2]
Cause and attribution
Security firm CertiK assessed the incident as a private-key compromise, one of the largest of 2023. Several analysts (e.g., X-explore) said the laundering patterns resembled those of the North Korea-linked Lazarus Group, though attribution was not officially confirmed. Sun said affected funds would be fully reimbursed and offered a 5% white-hat bounty; the attacker even mistakenly sent some stolen tokens to a contract, permanently losing them. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
