This Crypto Exchange Just Got Hacked for $26 Million

Decentralized exchange FixedFloat lost around 1,728 Ethereum (ETH) and 409 Bitcoin (BTC) through a drainer attack on Feb. 18, 2024. The exploiter sent the stolen funds to multiple Ethereum and Bitcoin addresses.

A hacker drained over $26 million worth of Bitcoin (BTC) and ETH from the decentralized exchange FixedFloat.

FixedFloat Confirms Hack of $26M

According to the threat researcher Officer’s Notes, the hacker transferred the ETH to multiple ETH addresses and then to the eXch exchange. The hacker then sent funds to two HitBTC addresses that received their initial ETH deposits almost simultaneously in 2021. The BTC was also sent to multiple addresses.

Officer’s Notes suggest the hacker could be framing the owner of the HitBTC addresses since they do not share anything in common other than the hacker’s address. The drainer’s address later received funds from Binance.

Read more: 15 Most Common Crypto Scams To Look Out For

fixedfloat drainer fund flows — Movement of FixedFloat Funds | Source: Peckshield

“I don’t see any addresses (other than the hacker’s address) that link these 2 HitBTC deposit addresses…Most likely, the hacker created only a false trail,” the investigator wrote.

Later, FixedFloat said they were recovering from the breach but were not ready to comment publicly. An earlier incident where a customer complained that they couldn’t withdraw money was blamed on a maintenance issue.

“We confirm that there was indeed a hack and theft of funds. We are not yet ready to make public comments on this matter, as we are working to eliminate all possible vulnerabilities, improve security, and investigate,” FixedFloat said.

BeInCrypto contacted the exchange for comments but did not reply at press time. They have since provided an official email channel for inquiries.

Wallet Drainer Attacks Escalate

The pace of crypto attacks has started to pick up in recent weeks. Singapore has raised red flags about a new drainer scam that drained the wallets of hopeful crypto airdrop recipients. According to the Singapore Police, the new crypto scam is perpetuated by so-called drainer kits sold on the darknet.

Crypto security firm BlockAid confirmed an increase in Solana wallet attacks in recent months. The hacker mimics the responses of genuine wallets when receiving funds from a transaction. Last week, they confirmed a Safe Vault attack by hacking group Angel Drainers that stole $403,000.

Read more: Top 5 Flaws in Crypto Security and How To Avoid Them

A drainer hack netted $900,000 Chainlink (LINK) tokens two weeks ago. According to Scam Sniffer, wallet drainers stole $295 million from $340,000 users last year.