HTX Hit With Unverified Dark Web Claim Over 6.5M User Records

A threat actor is peddling an unverified database on the dark web allegedly containing 6.5 million HTX user records. The visible portion of the data includes email addresses, phone numbers, and account identifiers bearing recent 2026 timestamps.

While the database structure labels highly sensitive fields like "google_auth," "password," and "KYC," it remains unproven whether the underlying data is actually decrypted, hashed, or empty. HTX has not confirmed the authenticity of the leak, which arrives shortly after the exchange suffered a widespread DDoS attack on August 31. The exchange previously experienced a confirmed security incident in 2023 that exposed contact information for 4,960 users.