How much was lost in the BingX hack?

$43M Stolen, as publicly reported (September 20, 2024).

Who was behind the BingX hack?

Publicly attributed to Lazarus Group 🇰🇵. ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/BingX

BingX Hack: $43M Stolen

Q: How was the BingX hack carried out?

Coordinated Hot Wallet Drain. At least 10 exploiter addresses drained BingX hot wallets across Ethereum and BSC simultaneously. The traced exploiter's first Ethereum activity begins at 05:05 UTC on September 20 — approvals followed immediately by router swaps.

September 20, 2024 · Ethereum · Lazarus Group 🇰🇵

stolen

$43M

parallel exploiter addresses

consolidated in first hour

283.95 ETH

addresses traced

160

What happened

On September 20, 2024, the BingX exchange lost ~$43M from its hot wallets in a multichain drain attributed to Lazarus Group. At least ten exploiter addresses worked in parallel; the one ChainHint traces swapped drained tokens to ETH through Uniswap's Universal Router within the first hour and forwarded 283.95 ETH to the operation's primary consolidation wallet. Endpoint attribution resolved one exchange deposit address among the terminals: even a Lazarus-scale laundering run touches custodial services where freezes are possible.

How the funds moved

Step 1

Coordinated Hot Wallet Drain

At least 10 exploiter addresses drained BingX hot wallets across Ethereum and BSC simultaneously. The traced exploiter's first Ethereum activity begins at 05:05 UTC on September 20 — approvals followed immediately by router swaps.

Step 2

Swap and Consolidate

Drained tokens were swapped to ETH via Uniswap's Universal Router, then 283.95 ETH moved to the operation's primary consolidation address on the morning of the drain.

Step 3

Exchange Off-ramp Attempts

ChainHint's endpoint attribution resolved one exchange deposit address among the unknown terminals — a custodial touchpoint in the laundering chain where KYC and freeze requests apply. The label behind it is unverified, so this page does not name the exchange.

Where the funds went

Read from the transfers in ChainHint's trace, not from press reports

First transfer

Sep 20, 2024

Last transfer traced

Feb 10, 2026

Hops traced

DEX swaps

ChainHint's trace of the BingX hack follows 448 transfers across 160 addresses and 6 hops, between Sep 20, 2024 and Feb 10, 2026.

Visualized attack path

160 addresses · 448 transfers · Traced with ChainHint

View Interactive Graph →

Key findings

Traced Exploiter

0x4928…9f7eExploiter #9 of ten documented BingX exploiter addresses (rekt.news). First active at the moment of the drain, swapped tokens to ETH and forwarded to the primary consolidation wallet the same morning.

Lazarus GroupMultichain Drain

Custodial Touchpoints

One exchange deposit addressAttribution resolved one exchange deposit address among the trace terminals. Funds that cross into custodial services are identifiable — a freeze request or legal disclosure order can reach them.

Freeze Possible

Consolidation Wallet

634 ETH absorbed in one dayThe primary consolidation address collected 634.30 ETH over four transfers on September 20, from three addresses including the exploiter this page traces.

Investigate your own incident

ChainHint traced the BingX hack in minutes.
Use the same tool for your case.