BitoPro Confirms $11.5M Hack After ZachXBT Blows the Whistle
Another day, another crypto exchange with a ’minor security oversight’—this time to the tune of eight figures. BitoPro just joined the hall of shame after blockchain sleuth ZachXBT exposed an $11.5 million exploit.
Who needs auditors when you’ve got Twitter detectives doing free forensic work? The exchange coughed up admission only after getting caught—classic ’ask for forgiveness, not permission’ crypto governance.
Meanwhile, somewhere in a boardroom, a CFO is still insisting ’cold wallets are overrated.’
BitoPro acknowledges security breach weeks after incident
【BitoPro Official Statement: June 2, 2025】
BitoPro recently experienced a cyberattack on an old hot wallet during a wallet system upgrade. Upon detection, we quickly launched an emergency response, securing assets by moving them to new wallets and blocking the attacker.
— BitoGroup 幣託集團 (@BitoEx_Official) June 2, 2025
BitoPro finally confirmed three weeks after the incident that it had suffered a wallet exploit. On June 2, the exchange said the breach occurred during a wallet system upgrade when an attacker exploited an “old hot wallet” during internal fund reallocation.
On May 9, BitoPro announced a maintenance period for the exchange, which was resolved on the same day. Deposits, withdrawals, and all trading functions remained operational while a third-party blockchain security firm was commissioned to trace the stolen funds.
However, many users have since reported being unable to withdraw USDT (USDT).
“We hereby declare that the platform has sufficient VIRTUAL asset reserves and user rights are not affected at all. Since the incident, user top-up, withdrawal and transaction functions have remained normal.”
–BitoPro
BitoPro promised to release its new hot wallet address for external inspection soon in order to demonstrate its commitment to asset security and transparency. The exchange’s team added that many of the platform’s assets were stored in cold wallets with no external connections for a long time and had never been affected, so the overall assets were safe.
The team also said it will continue to improve information security protection mechanisms, fine-tune wallet management processes and monitoring capabilities, and protect the asset security of every user.
ZachXBT believes BitoPro’s delay in publicizing breach was unnecessarily
Do you want to explain to the community why multiple of your hot wallets saw suspicious outflows of ~$11.5M on May 8, 2025 where you still have not disclosed the security incident on X or Telegram several weeks later? pic.twitter.com/HlD0c93Or4
— ZachXBT (@zachxbt) June 2, 2025
The crypto Sherlock Holmes also questioned BitoPro’s reluctance to publicize the hack and loss of funds on X or Telegram weeks (~25 days) after the alleged security incident.
He recently demanded real consequences, especially for underage SIM swappers and phishers, pointing out that Canadian and EU laws were a bit lenient on such young malicious actors.
However, SomaXBT, another scam survivor turned crypto-threats investigator, claimed that the BitoPro team was probably working in the background to recover the stolen funds to surprise their users with a great heist and recovery story.
The exchange users shared ZachXBT’s claim on the official BitoPro Telegram channel, where an administrator of the channel responded by saying they had just received numerous inquiries and WOULD respond accordingly after investigations were concluded.
As of the time of publication, the extent to which user assets on the exchange were affected remains unclear, and the attackers have not yet been identified.
Cryptopolitan Academy: Want to grow your money in 2025? Learn how to do it with DeFi in our upcoming webclass. Save Your Spot
