AscendEX

On December 11, 2021, AscendEX, a Singapore-based cryptocurrency exchange formerly known as BitMax, was hit by a sophisticated hack targeting its hot wallets, resulting in a $77.7 million loss across Ethereum ($60 million), Binance Smart Chain ($9.2 million), and Polygon ($8.5 million) blockchains, as reported by PeckShield and Merkle Science. Detected at 22:00 UTC, the breach involved 78 ERC-20 tokens, including $10.8 million in TARA and $10.7 million in USDT/USDC, plus 1568.2 BNB, 3749500 MATIC, $2.1 million in Litecoin, and $1.2 million in Bitcoin Cash, transferred to the attacker’s wallet (0x2c6900b24221de2b4a45c8c89482fff96ffb7e55, H1). Likely exploiting a hot wallet private key vulnerability, possibly via phishing, the hackers moved funds through multiple wallets (H2: 0x9eee6862b78fb6f9627d7d5a908d2114814fcecd, H3: 0x5629d0f06a984dab5f062aa8bb0eab75b94e7bf6, H4: 0x70dcf33ca09bd87bb2a301280331406ebd32c8a0), with $21.2 million sent to a major exchange via hops on December 20, and 512.2 ETH ($1.46 million) swapped via Uniswap on February 18, 2022, per Merkle Science.

AscendEX, with $101.6 million daily volume per CoinMarketCap, froze services, moved assets to cold storage, and reimbursed users fully, as announced on Twitter (@AscendEX_). Reddit’s u/CryptoVigilante lauded the reimbursement, but @Bitcoin_Archive criticized hot wallet reliance. Collaborating with Chainalysis and law enforcement, AscendEX blacklisted addresses, yet no funds were recovered in 2021’s regulatory void. The hack, among 169 blockchain incidents that year totaling $7 billion per AMBCrypto, prompted AscendEX to deploy a new hot wallet infrastructure with multi-signature controls, 2FA, and cold storage for 90% of assets, per BitDegree. The breach fueled demands for decentralized custody, real-time blockchain monitoring, and mandatory HSMs to secure the crypto ecosystem.