DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Phemex

Date (as written)
2025-01
Year
2025
Country
Singapore
Actor pages
Lazarus GroupTraderTraitor
Tags (as written)
Cryptocurrency FinancialGain
Dollar figures (as written)
$73 million; $85,085,704; 85 ($ Million); $85 million

Source entries (4)

lazarus.day

Phemex · 2025-01
On January 23, 2025, Phemex suffered a $73 million hack, with funds drained from hot wallets across 16 chains, including Ethereum, Solana, and XRP. The attack exploited access control vulnerabilities, enabling rapid and synchronized thefts. While cold wallets remained safe, the incident raised significant concerns about multi-chain security risks. Phemex temporarily suspended withdrawals and promised transparency, publishing proof of reserves to reassure users.
https://lazarus.day/incidents/phemex/

tayvano/lazarus-bluenoroff-research

Phemex · 2025-01-23
Amt Stolen: $85,085,704
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/phemex.md

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

Phemex · 2025-01-23
Table 3: DPRK Cryptocurrency Thefts, January - September, 2025. Date: 2025-01-23; Victim: Phemex; DPRK APT: TraderTraitor; Amount ($ Million): 85. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

Hackmageddon cyber attacks timelines (Paolo Passeri)

Phemex · 23/01/2025
Singapore-based cryptocurrency platform Phemex is forced to pause some of its operations after a suspected cyberattack led to the theft of more than $85 million in digital coins. [Date Occurred: 23/01/2025; Date Discovered: 23/01/2025]
https://www.hackmageddon.com/2025/06/04/16-30-january-cyber-attacks-timeline/
https://www.bleepingcomputer.com/news/security/hackers-steal-85-million-worth-of-cryptocurrency-from-phemex/

Values found later for empty fields

actors: Lazarus Group
Lazarus Group just connected the Bybit hack to the Phemex hack 2025-02-22 • Zach XBT
https://lazarus.day/reports/lazarus-group-just-connected-the-bybit-hack-to-the-phemex-hack-VwqeX/
actors: TraderTraitor
2025-01-23 Phemex TraderTraitor 85
https://msmt.info/Publications/detail/MSMT%20Report/4221

Suggest a correction on GitHub