Seychelles-based cryptocurrency exchange XT.com, with a trading volume of $3.4 billion, has stopped users from withdrawing their funds due to a suspected security breach. On November 28, the platform claimed that "wallet upgrade and maintenance" would prevent transactions. However, the blockchain security firm PeckShield later highlighted an illicit withdrawal of 12,500 ETH worth $1.7 million from XT.com's platform wallet.
The exchange admitted the occurrence in its public release, noting an "abnormal transfer of platform wallet assets." XT.com tried to relieve users' fears by informing everyone that customer funds are safe and have not been impacted. The exchange also pointed out that it currently holds more than 1.5 times the total amount of its users' assets to ensure customers' financial security.
As mentioned by PeckShield, the presumed hacker immediately exchanged the stolen funds for 461.58 Ether. The converted funds were transferred to an Ethereum wallet identified by the blockchain security firm. XT.com also reacted on its social network, saying that the stolen items were taken from its reserve and had no relation to the users' assets.
The exchange also stated its intention to start withdrawal services on November 29. Furthermore, XT.com pledged to increase transparency and announced that it would integrate a Merkle tree proof of reserves by mid-December.
Launched in 2018, XT.com is ranked as the 21st largest centralized crypto exchange by CoinGecko. It offers a trading platform for more than 1,000 cryptocurrencies and targets a wide pool of 'Crypto-users.' The exchange said it remains committed to user funds security and operation safety amid the attack and its team's investigation of the incident.
However, this failure shows concerns over the investment in centralized exchanges. The platform informed its users that only the exchange's assessment was compromised in the hack, resulting in a total loss of $1 million in 12 different currencies.
The breach of XT.com is conclusive that the rate at which hackers attack the cryptocurrency industry is escalating. By September 2024, cybercriminals had stolen $2.1 billion from various platforms, surpassing the $1.6 billion recorded in 2023. Experts predict that this figure will rise further by the end of the year.
Other major incidents this year include Radiant Capital's $50 million multi-chain exploit in October and WazirX's $235 million breach in July. These attacks highlight ongoing risks in the industry, emphasizing the importance of robust security measures for protecting both platform and user assets.