- Blockchain investigator ZachXBT identified unusual movements from BitoPro’s hot wallets and traced that the assets were being funneled through Tornado Cash and deposited into Wasabi.
- Despite the early warnings, BitoPro remained silent until public pressure mounted.
BitoPro, a Taiwan-based crypto exchange, has suffered a major security breach that has resulted in a loss of $11.5 million. The incident came to light after ZachXBT, the popular on-chain analyst, noticed unusual activity involving the platform’s hot wallets.
He flagged the suspicious outflows and then shared that the exchange may have been targeted and exploited. This event has raised concerns about the safety of funds on centralized crypto platforms.
How ZachXBT Noticed the Flaw and Bitopro Delayed Response
Earlier in the day, ZachXBT noticed some signs of trouble at Bitpro and shared it on his Telegram group. He first noticed some suspicious movements from the exchange’s hot wallets across different blockchain networks, including Ethereum, Tron, Solana, and Polygon.
He shared his findings and explained that the assets were either funneled through Tornado Cash or bridged to Bitcoin using Thorchain before landing in Wasabi, a known privacy wallet. As he was familiar with on-chain activities, he suspected that it was an exploit, and he suggested that the funds were being laundered to hide their origin.
Despite the seriousness of the findings, BitoPro didn’t release any valuable information to the public until hours after ZachXBT made his investigation known. After users started to share ZachXBT’s claims in the official BitoPro Telegram group, an admin responded, promising to give a response later.
It wasn’t until 5:12 PM (local time) that the exchange finally issued a formal statement in Chinese, confirming that the breach occurred during a wallet system upgrade. BitoPro explained that an old hot wallet had been compromised during the operation but assured users that they had carried out emergency actions and steps had been put in place to secure the remaining funds.
They also claimed that user assets are secure and the platform had enough reserves to cover all losses if any happened. However, the company has not shared any specific information as to how much or the exact time the breach happened, thereby frustrating users.
More Reading: How to Choose a Safe and Trustworthy Online Casino in 2025