BtcTurk Hit by $48 Million Cyberattack, Suspend Crypto Deposits and Withdrawals

Turkish cryptocurrency exchange BtcTurk has become the latest high-profile victim of a major cyberattack, suffering the theft of approximately $48 million in digital assets following a breach of its hot wallet infrastructure.

The security incident, which unfolded on August 14, 2025, quickly drew the attention of prominent blockchain analytics and security firms. Cyvers, an active blockchain security and threat intelligence platform, was among the first to alert the crypto community to the breach. According to on-chain tracking data shared by the firm, the stolen digital assets were rapidly siphoned off and dispersed across multiple prominent blockchain networks.

The multi-chain nature of the attack highlighted the sophisticated capabilities of the threat actors involved. The compromised funds were traced across networks including Ethereum, Avalanche, Arbitrum, Base, Optimism, Mantle, and Polygon. Following the cross-chain transfers, the vast majority of the stolen digital assets were consolidated into just two primary recipient addresses. Blockchain monitors noted that the attacker quickly began the process of swapping the stolen tokens, a common maneuver used by hackers to obfuscate the trail of funds and prepare them for laundering across decentralized finance protocols or cross-chain bridges.

BtcTurk, one of the most prominent and largest cryptocurrency trading platforms in Turkey with a user base exceeding five million registered accounts, swiftly acknowledged the security breach. The company published an official statement on the social media platform X to address mounting user concerns and clarify the scope of the incident.

In its official communication, the exchange confirmed that the unauthorized activity was strictly confined to its hot wallets—the internet-connected storage systems that facilitate rapid liquidity for day-to-day trading and withdrawal operations.

"During checks conducted on August 14, 2025, unusual activity was detected in our hot wallets," BtcTurk stated in its announcement. "As a precaution, cryptocurrency deposit and withdrawal transactions have been temporarily suspended. These services will be reactivated once the work is completed."

To calm jittery markets and reassure its vast customer base, BtcTurk emphasized that the financial impact of the hack was heavily mitigated by its risk management and asset storage policies. The company assured users that the overwhelming majority of customer cryptocurrency holdings are safely secured in offline, air-gapped cold wallets, which remained entirely untouched by the breach. Consequently, the exchange maintained that customer balances outside of the compromised hot wallets are secure and will not be impacted by the losses.

Furthermore, the platform clarified that standard trading operations and Turkish Lira (TRY) fiat deposits and withdrawals continued to function normally throughout the ordeal, preventing a total operational standstill for the exchange. BtcTurk management noted that local law enforcement and regulatory authorities had been formally notified of the cyberattack. The exchange’s internal security personnel are currently coordinating closely with specialized external cybersecurity forensic teams to thoroughly investigate the vector of the attack, secure the platform’s underlying digital infrastructure, and determine how the hot wallets were breached.

The timing of the incident has drawn sharp scrutiny from the broader cryptocurrency industry, as it marks the second consecutive year that BtcTurk has fallen victim to a major hot wallet exploit. Roughly a year prior, the exchange suffered a strikingly similar security breach that resulted in significant losses exceeding $55 million. During that previous incident in June 2024, hackers managed to infiltrate hot wallets holding a portfolio of ten different cryptocurrencies, though cold storage assets similarly remained insulated from the compromise at the time. The repetition of hot wallet vulnerabilities has placed renewed pressure on centralized exchanges to re-evaluate their treasury management protocols, internal access controls, and hot-to-cold asset allocation ratios.

Centralized exchanges under attack

This latest security breach at BtcTurk underscores a broader, deeply concerning trend of escalating cyberattacks targeting centralized cryptocurrency trading platforms throughout the industry. Centralized exchanges, which custody billions of dollars in digital assets on behalf of millions of retail and institutional users worldwide, continue to remain primary targets for sophisticated state-sponsored hacking syndicates and organized cybercrime groups.

The year 2025 has already witnessed a staggering accumulation of high-value exploits across the global cryptocurrency exchange ecosystem. Earlier in the year, Bybit, one of the world’s leading derivatives and spot crypto exchanges, suffered a catastrophic security breach that resulted in the theft of approximately $1.5 billion worth of Ethereum tokens. Investigations into the Bybit exploit later tied the vulnerability to a compromise involving developer machine infrastructure associated with Safe multisig protocols, illustrating how deeply supply chain and third-party software vulnerabilities can penetrate even the most well-funded trading platforms.

The wave of high-profile thefts has not spared regional exchanges either. Major platforms in emerging and established crypto markets alike have found themselves in the crosshairs of malicious actors. For instance, India-based prominent cryptocurrency exchange CoinDCX recently fell victim to a devastating security incident, losing more than $44 million in digital assets in a heist that blockchain intelligence analysts subsequently linked to the notorious, North Korea-backed Lazarus Group.

As digital asset valuations fluctuate and the technological sophistication of threat actors continues to evolve, the repeated targeting of hot wallets at exchanges like BtcTurk highlights the persistent structural vulnerabilities inherent in maintaining online liquidity pools. While cold storage remains the gold standard for long-term asset protection, the necessity of hot wallets for seamless exchange operations continues to present an attractive attack vector. For BtcTurk and the wider centralized exchange industry, the ongoing incidents serve as a stark reminder of the relentless security challenges facing the digital economy, prompting renewed calls for heightened transparency, advanced multi-party computation (MPC) custody solutions, and more rigorous real-time monitoring of network transactions.