HECO Bridge 2023 operator-key compromise
On November 22, 2023, HECO Bridge was drained after the bridge operator wallet was compromised. HTX confirmed a cyberattack affecting HTX and HECO Chain and suspended affected transfer services; independent security analysis attributed the bridge component to operator-key compromise and estimated approximately $86.6 million drained from HECO Bridge.
Incident facts
- Incident title
- HECO Bridge 2023 operator-key compromise
- Bridge
- HECO Bridge
- Incident date
- 2023-11-22
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Ethereum, Unknown
- Affected assets
- Unknown
- Attack category
- Private Key Compromise
- Reported loss
- Approximately $86.6 million
- Amount confidence
- Medium
- Loss amount basis
- Independent Security Analysis Corroborated By Contemporaneous Reporting
- Recovery
- Unknown
- Reimbursement
- Unknown
- Restart
- Paused
- Current outcome
- Unknown
- Postmortem
- Partial
- Resolution
- Unresolved
- Last reviewed
- 2026-09-04
- Last verified
- 2026-09-04
Amount and valuation
Independent security analysis and contemporaneous reporting estimated approximately $86.6 million drained from HECO Bridge. HTX separately reported hot-wallet losses; those exchange losses are excluded from this bridge amount.
The canonical amount is bridge-specific. It must not be combined with HTX hot-wallet losses disclosed in the same incident window.
HECO Bridge drainapproximately $86.6 million
Bridge-specific estimate from CertiK; HTX exchange hot-wallet losses remain outside this claim.
Why this remains unresolved
- Final HECO Bridge attacker-fund recovery is not established in the admitted evidence.
- HTX hot-wallet compensation does not establish HECO Bridge reimbursement.
- A dated unrestricted HECO Bridge reopening is not established.
Timeline events
HECO Bridge compromised and affected transfer services suspended2023-11-22
HTX confirmed a cyberattack affecting HTX and HECO Chain and suspended affected deposits, withdrawals, and the HECO Chain gateway while investigating. Independent analysis attributed the bridge drain to compromise of the bridge operator wallet.
HTX hot-wallet compensation is outside the HECO Bridge reimbursement boundary.
Evidence records
- HTX and HECO Chain Suffer CyberattackHTX · Tier 1 · High reliability · primary · 2023-11-22Claim scope: Incident Case
Primary evidence for the combined HTX/HECO attack response and gateway suspension. The notice quantifies HTX hot-wallet impact only, so it is not used for the HECO Bridge loss amount.
- Heco Bridge ExploitCertiK · Tier 1 · High reliability · secondary · 2023-11-23Claim scope: Root Cause
Independent technical analysis supporting bridge-operator/private-key compromise and the approximately $86.6 million HECO Bridge-specific loss estimate.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- The official HTX notice did not publish a bridge-specific technical root cause; operator-key compromise is supported by independent security analysis.
- Final recovered amount and reimbursement status remain unknown.
- Current unrestricted bridge operation is not established by the reviewed source package.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.