Turkish crypto exchange BtcTurk is facing allegations of a $48 million security breach in a coordinated multi-chain attack targeting its hot wallets.
The exploit, first detected by blockchain security firm Cyvers, involved suspicious transfers across Ethereum, Avalanche, Arbitrum, Base, Optimism, Mantle, and Polygon networks, with most funds consolidating into just two recipient addresses.
Following the detection, BtcTurk immediately suspended all cryptocurrency deposits and withdrawals, stating in Turkish that operations were halted “due to a technical problem in hot wallets” while assuring users that fiat currency transactions remained unaffected.
Coordinated Multi-Chain Attack Targets Hot Wallets
According to Cyvers’ initial alert, its monitoring system flagged the unusual activity approximately 30 minutes after transfers began, with attackers quickly consolidating assets into two primary wallets before beginning systematic cryptocurrency swaps for more liquid tokens.
The security firm noted direct communication with BtcTurk’s team that implemented “immediate action” protocols while maintaining that fiat currency operations remained unaffected by the technical disruption.
BtcTurk’s official Turkish-language statement described the suspension as precautionary, emphasizing that “purchase and sale operations and Turkish Lira withdrawal operations continue uninterrupted” during its ongoing investigation.
The exchange’s response avoided using terms like “hack” or “breach,” instead characterizing the situation as operational difficulties requiring temporary security measures.
Blockchain investigators provided specific wallet addresses for public tracking, allowing real-time monitoring of the suspected stolen funds’ movement across different networks and exchanges.
Independent analysis revealed that the attackers began swapping various cryptocurrencies for Ethereum almost immediately after the initial transfers, suggesting preparation for rapid liquidation through decentralized exchanges.
BtcTurk has not provided a timeline for resuming cryptocurrency operations, stating only that services will resume “as soon as notification is made” following its security assessment.
Regional Exchanges Face Escalating Security Risk
This suspected breach marks BtcTurk’s second major security incident within 14 months, following a confirmed $54 million loss in June 2024 that specifically targeted Avalanche token holdings.
During the previous incident, blockchain investigator ZachXBT conducted a timing analysis linking approximately $54 million in suspicious Avalanche transfers to the Turkish exchange, while Binance later froze $5.3 million of recovered stolen funds.
The Turkish crypto market’s rapid growth amid domestic currency instability further creates unique operational pressures for local exchanges, which must balance user accessibility with increasingly sophisticated security threats.
However, the pattern extends beyond Turkey, with regional exchanges across emerging markets experiencing similar attack vectors targeting hot wallet infrastructure.
Iran’s Nobitex lost $73 million through TRON-based exploits involving attackers who used provocative vanity addresses containing politically charged messages while claiming affiliation with pro-Israel hacker groups.
Similarly, India’s CoinDCX suffered $44 million in losses from server breaches, with the exchange waiting 17 hours before acknowledging the incident after blockchain investigators publicly flagged suspicious activities.
Meanwhile, the global crypto industry has experienced an alarming surge in security breaches throughout 2025, with CertiK reporting over $2.2 billion in losses from hacks and scams in just the first half of the year.
Major incidents like Bybit’s $1.5 billion hack and Cetus Protocol’s $225 million exploit have skewed yearly statistics, yet even without these outliers, losses align with previous years at approximately $690 million.
The frequency of these breaches raises questions about whether regional exchanges can maintain competitive operational costs while implementing security measures comparable to industry leaders like Coinbase or Binance.
