Phishing Attack Drains $14M from WOO X—Team Member’s Device Compromised

Another day, another crypto exploit—except this time, it wasn’t a smart contract flaw or a rogue validator. Hackers pulled off a $14M heist by targeting the weakest link in the chain: human error.

How? A single phishing attack on a WOO X team member’s device gave attackers the keys to the kingdom. No fancy zero-day exploits, just good old-fashioned social engineering. So much for 'not your keys, not your crypto' when the custodians themselves get played.

Security teams are scrambling to patch the breach, but the damage is done. Meanwhile, traders are left wondering if centralized exchanges are just glorified honeypots. At least the hackers didn’t rug pull—they went straight for the jugular.

Remember folks: in crypto, the biggest vulnerabilities aren’t in the code—they’re behind the keyboard. And maybe, just maybe, that 'unhackable' system isn’t as bulletproof as the marketing whitepaper claims.

Withdrawals paused as investigation continues

Withdrawals across the platform were suspended as a precaution, with the exchange saying it is prioritizing a full forensic review and the SAFE restoration of services. “We are working with external security teams and other exchanges to halt the flow of funds,” the company stated. 

WOO X has published six wallet addresses linked to the attacker and is actively tracking the stolen funds across chains. A timeline for restoring withdrawals will be disclosed once the full forensic review is complete. 

The company emphasized that the breach was limited to nine high-value accounts and that Core infrastructure remains secure.

The incident adds to a rising number of centralized exchange breaches in July. On July 19, CoinDCX was exploited for $44.2 million via a Solana-to-Ethereum bridge, while BigONE lost over $27 million earlier this month from a hot wallet hack.