Poloniex Hot Wallet Drain

On November 10, 2023, blockchain security firms PeckShield and Cyvers raised the alarm on a coordinated drain of Poloniex's hot wallets. Total losses settled at $114 million on Ethereum plus approximately $42 million on Tron — bringing the cumulative loss to roughly $156 million across two chains affiliated with Justin Sun's operation.

What happened

The Ethereum-side "Poloniex hacker" address executed 357 transactions in rapid succession, sweeping over $100M from hot wallets controlled by the exchange. In parallel, a Tron-side address moved roughly $42M to a separate set of destinations.

Justin Sun and Poloniex publicly characterised the breach as a private-key compromise — the keys controlling the hot wallets had been stored within Poloniex's internal systems and were extracted by the attacker, who then escalated privileges and moved funds in a single coordinated window.

Aftermath

• Poloniex paused withdrawals within hours; deposits resumed days later, withdrawals weeks later, after key rotation and audit.
• Justin Sun publicly committed to 100% user reimbursement from corporate reserves and offered a 5% white-hat bounty to the attacker for return of funds, with a 7-day deadline before engaging law enforcement. The deadline passed.
• The same operator infrastructure was implicated two weeks later in the HECO Bridge / HTX drain on November 22 — a related compromise affecting other Justin Sun-affiliated platforms.

Why it matters

Poloniex is one half of a tightly-paired pair of incidents (the other half being HECO/HTX two weeks later) that exposed the shared key-management exposure across Justin Sun's affiliated infrastructure. When one operator runs an exchange, a bridge, and an L1, the security boundary of the whole portfolio collapses to the operational security of the central key-management system.

The lesson — strict per-business HSM isolation, no shared signing authority — has driven the modern push toward enclave-based per-service key managers in the operator playbook.