In one of the most significant exchange breaches of 2020, Slovakia-based cryptocurrency exchange Eterbase confirmed on September 8, 2020, that its hot wallets had been compromised, resulting in the theft of approximately $5.4 million worth of digital assets. The incident sent ripples through the European crypto community and reignited concerns about exchange security practices.
TL;DR
- Eterbase, a European crypto exchange headquartered in Slovakia, suffered a hot wallet breach on the night of September 7, 2020
- Six hot wallets were compromised across multiple blockchains including Bitcoin, Ethereum, XRP, Tron, Tezos, and Algorand
- Approximately $5.4 million in cryptocurrency was stolen
- The exchange immediately halted deposits and withdrawals while investigating the attack
- The hack highlighted persistent vulnerabilities in single-signature hot wallet architectures
The Attack: What Happened
Eterbase first disclosed the breach through its official Telegram channel and Twitter account on Tuesday, September 8, 2020. According to the exchange’s statement, attackers gained access to six of its cryptocurrency hot wallets during the night of September 7. The compromised wallets contained Bitcoin (BTC), Ethereum (ETH) and ERC-20 tokens, XRP, Tron (TRX), Tezos (XTZ), and Algorand (ALGO).
Blockchain analysis later revealed that the hackers transferred approximately 11.45 BTC and 387.4 ETH from Eterbase hot wallets to addresses under their control. The total losses were estimated at roughly $5.4 million, with the majority — around $4 million — in Ethereum and various ERC-20 tokens. Additional losses included approximately $500,000 in Tezos, over $100,000 in Bitcoin, and roughly $45,000 in Tron.
How the Hackers Operated
Security researchers from Merkle Science traced the movement of stolen funds and uncovered a sophisticated laundering operation. After consolidating the stolen cryptocurrency, the hackers employed a technique known as “chain peeling” — breaking larger amounts into smaller transactions before distributing them across multiple cryptocurrency exchanges for liquidation.
Notably, the attackers appeared to have pre-existing accounts on major exchanges, suggesting a level of operational planning beyond a typical opportunistic attack. They consolidated both stolen and previously held funds into single clusters before redistributing them, making forensic tracking more challenging.
Security Vulnerabilities Exposed
The Eterbase hack underscored a recurring theme in cryptocurrency exchange security: the dangers of single-signature hot wallets. Unlike multi-signature wallets that require multiple authorizations before funds can be moved, Eterbase’s hot wallets stored private keys in internet-connected databases with no additional approval layers.
This meant that once attackers gained access to the server infrastructure — likely through compromising the database where private keys were stored — they could sign and execute withdrawal transactions without any further barriers. Security experts noted that multi-signature protection, while not foolproof, would have significantly raised the difficulty and detection probability of such an attack.
Eterbase’s Response
Following the breach, Eterbase immediately suspended all deposit and withdrawal services and placed the exchange into maintenance mode. In a message to users, the platform assured clients that it was taking all necessary steps to protect remaining funds and investigate the incident. The exchange also stated it was cooperating with law enforcement authorities to identify the perpetrators.
Some stolen funds were later recovered through cooperation with other exchanges. ChangeNOW, a cryptocurrency exchange service, reportedly returned approximately $1 million in stolen assets after being alerted to the hack.
Why This Matters
The Eterbase hack was the second significant exchange breach targeting a European platform in 2020, following the Altsbit incident in February. Together, these attacks highlighted that even as the crypto industry matured, fundamental security practices — particularly around hot wallet management — remained inconsistent across exchanges.
For users, the incident served as a stark reminder of the risks inherent in leaving significant funds on centralized exchanges. The crypto community has long advocated for self-custody through hardware wallets, and events like the Eterbase hack reinforced that guidance. With Bitcoin trading around $10,131 and Ethereum at $337 at the time of the attack, the $5.4 million loss represented a meaningful but not catastrophic sum — yet it demonstrated how quickly a single security lapse could result in substantial losses.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always conduct your own research before making any investment decisions.
Eterbase was one of the first exchanges to actually try compliance in Eastern Europe. Their KYC process was thorough. But none of that matters when your hot wallet keys are stored on a compromised server.
The fact that funds were traced to Binance shows how quickly law enforcement can now follow blockchain transactions. Cold comfort for the victims though.
another day another exchange hack when will people learn basic opsec. 6 hot wallets drained because of shared infrastructure. textbook failure.
European exchanges were particularly vulnerable in 2020. Smaller teams less security budget but same attack surface as the big players. Eterbase was not the only one.