BingX offered the attacker up to 10% of stolen assets for returning them after unauthorized access to a hot wallet was detected on September 20, 2024. Blockchain investigators estimated losses in the mid-$40 millions, but the exact total is unsettled. The offer was not proof of a recovery: the sources available do not confirm that the funds were returned or that a bounty was paid.
What happened to BingX?
BingX said it detected unauthorized access to a hot wallet at about 4:00 a.m. Singapore time (UTC+8) on September 20, 2024. It activated emergency procedures, moved assets and suspended deposits and withdrawals. The exchange initially described the loss as minor while it calculated the amount. Its incident FAQ describes the event as unauthorized access to a hot wallet; the public information cited here does not establish the precise intrusion method.
A hot wallet is connected to systems used to process transactions, unlike a cold wallet kept offline. The incident therefore concerned a wallet breach, not evidence that every BingX account or the exchange’s entire reserve was compromised.
How much cryptocurrency was stolen?
There is no single confirmed final dollar figure. Independent estimates vary with the wallets and tokens counted and the prices used to value them.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| Source | Reported estimate | Basis or qualification |
|---|---|---|
| Bitrace, as reported by Cybernews | More than $43.5 million | Transfers from three BingX-linked addresses. |
| Match Systems, as reported by Cybernews | More than $48 million | Funds traced from nine wallets. |
| SlowMist | Approximately $45 million | Figure in its 2024 annual security report. |
| Other industry reporting, summarized by Cybernews | Around $44 million or $52 million | Different asset counts and valuation methods; the underlying calculations are not specified in the cited summary. |
The estimates and their attributions are reported by Cybernews and in SlowMist’s 2024 report. The frequently used “$44 million” headline figure should be read as a rounded estimate, not an audited final loss.
What did the 10% bounty promise?
According to the message reported by Cybernews and attributed to Bitrace, BingX offered the attacker up to 10% of the stolen assets if they returned the funds within 48 hours. The stated deadline was 00:00 UTC on September 24, 2024. BingX reportedly said it would stop tracking and pursuing the attacker if the funds were returned; otherwise, it would continue working with law-enforcement and security agencies.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
This was a post-theft recovery offer, not a conventional vulnerability bounty. A separate BingX–HackenProof announcement describes a vulnerability-reporting program with rewards of up to $4,000. That program is distinct from the offer to return stolen assets.
A recovery payment can give a thief a reason to return funds that may be difficult to launder or cash out. But a private promise by an exchange to stop pursuing someone cannot necessarily bind law enforcement, and an announced offer does not show that negotiations succeeded. In this case, the available reporting does not verify a return of funds or payment of the 10% reward.
Recommended Free Tools
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
How were BingX customers affected?
The documented immediate customer impact was disruption to deposits and withdrawals. BingX said trading remained operational while those services were paused. The exchange also said most assets were held in cold wallets, user assets remained safe and unimpaired, and reserves covered the loss. These are BingX’s assurances; the sources cited here do not demonstrate an independent audit verifying them.
Restoration was staged, and availability could differ by asset and network:
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
- September 20, 2024: Deposits and withdrawals were suspended after the incident was detected.
- By September 21, 08:30 UTC+8: Withdrawals for major assets had resumed. BingX named USDT, USDC, BTC, ETH, TRX, XRP and SOL among the initial assets.
- September 22, 08:30 UTC+8: Deposits resumed for an initial group of assets.
- September 26: BingX said withdrawals for additional altcoins had been restored.
- September 29: BingX said 129 cryptocurrencies had been restored.
The dates and service updates appear in BingX’s incident FAQ and its September 30 progress release. Restoring access to services is operational recovery; it does not establish that the stolen cryptocurrency was recovered.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What changes did BingX announce afterward?
In its progress release, BingX said it overhauled wallet systems, strengthened wallet protections, improved threat detection and real-time monitoring, conducted additional security audits, and worked with security organizations including SlowMist and Chainalysis. It also announced a fully financed safety fund from its own capital to support withdrawals and cover potential losses. These are measures the exchange said it took; they do not prove that future incidents are impossible.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBest Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Was the attack linked to the Lazarus Group?
SlowMist’s 2024 report said its MistTrack analysis found possible links between the BingX incident and the Indodax hack, including laundering through addresses associated with the Lazarus Group. That is an analytical lead about possible links among transactions and addresses, not a definitive public finding that Lazarus carried out the BingX breach.
Quick Recap
What remains unverified?
- The exact final value of the assets taken and the full set of wallets included in that calculation.
- The initial access method and the attacker’s identity.
- Whether any stolen funds were returned or the bounty was paid.
- Whether users suffered an unreimbursed loss; BingX said balances were covered, but independent verification is not established by the sources cited here.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
