ETERBASE reported that attackers compromised six exchange hot wallets on September 7, 2020, stealing more than $5 million in BTC, ETH and ERC-20 tokens, XRP, TRX, XTZ, and ALGO. Merkle Science assessed the likely failure as exposed hot-wallet private keys without multi-signature controls, allowing the attackers to sign outgoing transactions after gaining server access. The analysis traces 11.45 stolen BTC into a 14-address cluster and then through consolidation and chain peeling, while 387.4028 ETH moved from the ETERBASE hot wallet into the attacker's main Ethereum address before being split across several destinations.