BitoPro, a Taiwanese crypto exchange, confirmed on Monday that it was “attacked by hackers” during a recent system upgrade after a crypto sleuth brought attention to $11.5 million worth of suspicious withdrawals from the platform.
An old hot wallet—a crypto wallet that is connected to the internet, as opposed to a cold wallet, which is not—had been targeted by hackers during a “recent wallet system upgrade and asset transfer operation,” BitoPro announced via Telegram on Monday.
The revelation came hours after ZachXBT, a pseudonymous crypto investigator, reported on Telegram that the exchange “was likely exploited for ~$11.5 million on May 8, 2025.”
While BitoPro did not disclose how much money was stolen in the breach, the statement said that the platform has “sufficient virtual asset reserves” to maintain customer funds and company operations.
“Since the incident, user top-up, withdrawal and transaction functions have maintained normal operation,” the company said in the statement.
BitoPro did not immediately respond to a request for comment from Fortune.
Since the company’s announcement on Monday, trading volume on the exchange has fallen 21%, according to crypto data platform CoinGecko.
The news of BitoPro’s hack follows a separate announcement from Coinbase last month that criminals had stolen the personal data of tens of thousands of its customers. In an SEC filing about the incident, Coinbase estimated that the incident could cost as much as $400 million in “remediation costs and voluntary customer reimbursements.”
These recent breaches add to an already historic year for crypto exchange hacks. In February, hackers stole a record $1.5 billion from Dubai-based crypto exchange ByBit. Not only was it the largest hack of a crypto exchange, it was the largest heist of all time.
The ByBit hack and many others have been traced back to a collective of North Korean hackers that present a growing threat to companies and governments worldwide. The hacker group, whose goal is to pilfer enough money to support the country’s economy in the face of sanctions, has successfully infiltrated multiple crypto companies using techniques ranging from social engineering—like impersonating an IT worker—to technological exploitations and installing malware.
