[New Bug Bounty] BtcTurk Launches $2.4M Recovery Bounty Program after a $48M exploit

Introduction

On 14th August, BtcTurk experienced unauthorized transfers involving multiple cryptocurrencies, with losses totaling approximately $48 million USD. The incident involved large transfers of ether (ETH), Avalanche’s AVAX (AVAX), Arbitrum’s ARB (ARB), Base (BASE), Optimism’s OP (OP), Mantle and Polygon’s MATIC (MATIC), with the bulk of the funds consolidating into several recipient addresses.

The team has launched an $2.4 million recovery bounty program — up to 5% of any recovered funds — for actionable intelligence that directly contributes to the recovery of stolen assets.

What Happened? (Incident Summary)

BtcTurk’s hot wallets were compromised in a coordinated attack, leading to unauthorized transfers worth ~$48M across multiple blockchains.

The incident was immediately contained by halting deposits and withdrawals.

• Core trading operations and fiat (TRY) services remain unaffected
• The vast majority of customer funds are secured in cold wallets
• Law enforcement and cybersecurity partners are engaged in the investigation

BtcTurk has launched a Hack Recovery Program with rewards of up to $2.4M to facilitate fund recovery.

Where do things stand?

Stolen Assets Destination Addresses:

• Ethereum: 0xA041FeB3a8297c5689FEE180083164A061a17fD6
• Ethereum: 0xb4b537626e21df5386cf167d1e654b38785056cc
• Ethereum: 0x7d91d1ebeba91257733a523409125aedac5d8b6e
• Bitcoin: bc1q3xgyvmfk6mw6zvhjklsw7v8wl2dk0xtm35ulut

Subsequent Related Addresses:

• Ethereum: 0x95Ab53305bC71D0e6e2d46F2E62690599CBC87Fc
• Ethereum: 0xDDFA0884f32d0D210597A996060fbDB5b068b0Ea
• Ethereum: 0x0fE41fe8786329fB6bd8F2baa73aa55e770f0951

Rewards and Rules

• Bounty Reward: Up to 5% of all successfully recovered funds.
• Potential Pool: Up to $2.4 million, if full recovery is achieved.
• Objective: Reward program participants who assist in locating, securing, and retrieving these funds back to BtcTurk.

This is open to ethical hackers, white-hat researchers and anyone committed to making crypto safer.

• All submitted intelligence must comply with applicable laws and ethical standards.
• Do not engage in unauthorized access, exploitation of systems without consent, or any activity that violates the law.
• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Please do NOT publish/discuss bugs.
• Reports must not include personally identifiable information (PII) obtained through unlawful or unethical methods.
• Rewards are subject to internal verification and compliance review.
• High-value rewards may require Anti-Money Laundering (AML) and Know Your Customer (KYC) verification.

How to Participate

All submissions are accepted through the HackenProof platform. Participants can submit vulnerability details or report cyberattack information related to the fund recovery. Details, requirements and submission form are available on the program page.