DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

AlexLab

Date (as written)
2024-05
Year
2024
Country
Singapore
Actors (as written)
Lazarus
Actor pages
Lazarus
Tags (as written)
FinancialGain Cryptocurrency
Dollar figures (as written)
$4.3 million; $27,400,000; 4.3 ($ Million); $4,300,000; $4 million

Source entries (5)

lazarus.day

AlexLab · 2024-05
AlexLab experienced a $4.3 million exploit due to a compromised private key, impacting their XLink bridge on the BNB network. The attacker used phishing to gain control of the vault keys, allowing them to drain 13.7 million STX, with 3 million STX sent to exchanges. Some funds were recovered, but many remain unrecovered.
https://lazarus.day/incidents/alexlab/

tayvano/lazarus-bluenoroff-research

ALEX Labs · 2024-05-15
Amt Stolen: $27,400,000
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/alex_labs.md

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

ALEX Lab · 2024-05-15
Table 2: DPRK Cryptocurrency Thefts, January - December, 2024. Date: 2024-05-15; Victim: ALEX Lab; DPRK APT: CryptoCore; Amount ($ Million): 4.3. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

SlowMist 2024 Blockchain Security and Anti-Money Laundering Annual Report, section 3.3 DPRK (table 'attributed to DPRK-affiliated groups, with data from SlowMist Hacked')

ALEX Labs · May-15, 2024
The following is a chronological list of significant incidents attributed to DPRK-affiliated groups, with data from SlowMist Hacked: ... May-15, 2024 ALEX Labs $4,300,000
https://www.slowmist.com/report/2024-Blockchain-Security-and-AML-Annual-Report(EN).pdf

Hackmageddon cyber attacks timelines (Paolo Passeri)

Alex Lab · 25/06/2024
Bitcoin decentralized finance protocol Alex Lab says that a $4 million exploit it suffered last month is likely linked to North Korea Lazarus Group. [Date Occurred: 16/05/2024; Date Discovered: 16/05/2024]
https://www.hackmageddon.com/2024/09/26/16-30-june-2024-cyber-attacks-timeline/
https://www.databreachtoday.com/cryptohack-roundup-conviction-in-home-invasions-case-a-25639

Suggest a correction on GitHub