CoinEx

Date (as written): 2023-09
Year: 2023
Country: United States
Actors (as written): Lazarus
Actor pages: Lazarus
Tags (as written): FinancialGain Cryptocurrency
Dollar figures (as written): $31 million; $54,000,000; $54 million; 70m; $ 70,000,000; US$70 million; around $54 million; $41M; at least $291.3 million across five distinct incidents in 2023 (combined); $53 million

Source entries (11)

lazarus.day

CoinEx · 2023-09

CoinEx detected anomalous withdrawals from multiple exchange hot-wallet addresses on September 12, 2023 and suspended deposits and withdrawals while investigating unauthorized transactions involving assets including ETH, TRON, MATIC, BTC, XRP, BCH and SOL. SlowMist and later reporting attributed the theft to North Korea's Lazarus Group, while CertiK linked CoinEx to a broader 2023 Web3 breach cluster affecting Atomic Wallet, Alphapo, CoinsPaid and Stake through on-chain correlations across Ethereum and Tron infrastructure.

https://lazarus.day/incidents/coinex/

ThaiCERT Threat Group Cards

CoinEx confirms hack after $31 million in cryptocurrency allegedly stolen from exchange · 2023-09

CoinEx confirms hack after $31 million in cryptocurrency allegedly stolen from exchange https://therecord.media/coinex-confirms-hack-after-31-million-allegedly-stolen https://therecord.media/coinex-cryptocurrency-heist-north-korea

https://therecord.media/coinex-confirms-hack-after-31-million-allegedly-stolen

https://therecord.media/coinex-cryptocurrency-heist-north-korea

tayvano/lazarus-bluenoroff-research

CoinEx · 2023-09-12

Amt Stolen: $54,000,000

https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/coinex.md

CFR Cyber Operations Tracker

Targeting of CoinEx cryptocurrency exchange · Sep 2023

Lazarus Group stole almost $54 million in various cryptocurrencies from the CoinEx exchange. Some of the funds were moved into a wallet that contained stolen funds from an earlier theft of cryptocurrency from the Stake.com gambling platform.

https://www.cfr.org/cyber-operations/targeting-of-coinex-cryptocurrency-exchange

https://announcement.coinex.com/hc/en-us/articles/19187420867348-Latest-Progress-of-the-Hacking-Attack-on-Sep-12-2023-Updated-on-Sep-14

https://archive.ph/IPO6b

https://www.certik.com/resources/blog/216tegKHtRmx5pOI3UgYCX-lazarus-groups-web3-rampage

UN Panel of Experts S/2024/215

CoinEx · 12 September 2023

Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2023: Victim: CoinEx; Date: 12 September; Amount (USD equivalent): 70m; Location: Hong Kong, China

https://undocs.org/S/2024/215

SlowMist Hacked (hacked.slowmist.io)

CoinEx · 2023-09-12

Description of the event: The cryptocurrency exchange CoinEx suffered a hacker attack. The cause of the incident was initially determined to be the leakage of hot wallet private keys. The damage caused is estimated to have reached US$70 million, and the impact has affected multiple blockchains. CoinEx tweeted that it had identified and quarantined suspicious wallet addresses related to the hack and that deposit and withdrawal services had been suspended. On September 13, SlowMist found during the analysis process that CoinEx hackers were related to Stake.com hackers and Alphapo hackers. CoinEx hackers may be the North Korean hacker group Lazarus Group. | Amount of loss: $ 70,000,000 | Reference: https://twitter.com/coinexcom/status/1701662057496731975

https://hacked.slowmist.io/

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

CoinEx · 2023-09

Reported: 2023-09; Victims: CoinEx; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: United States

https://data.mendeley.com/datasets/wwb2rzgfn7/2

Elliptic blog: How the Lazarus Group is stepping up crypto hacks and changing its tactics

CoinEx exchange hack (suspected) (September 12th 2023) · Sep 15, 2023

Finally, on September 12th 2023, centralized crypto exchange CoinEx was the victim of a hack, in which $54 million was stolen. ... Elliptic agrees that Lazarus Group should be suspected for the theft of funds from CoinEx.

https://www.elliptic.co/insights/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics/

ZachXBT Telegram channel t.me/investigations (public web view)

CoinEx hack (funds moving; linked to Stake hack wallet) · 2023-09-13 (post date)

Update: This hack appears to have been done by North Korea. One hour ago they were moving funds from the CoinEX hack to 0x75 on OP. 0x75 on Polygon was funded from the $41M Stake hack.

https://t.me/investigations/40

CertiK blog: Lazarus Group's Web3 Rampage

CoinEx breach · published 2023-09-13

CertiK has identified transactions connecting the Atomic Wallet, Alphapo, CoinsPaid, Stake.com, and CoinEx breaches, serving as on-chain evidence of Lazarus Group's involvement.

https://www.certik.com/resources/blog/216tegKHtRmx5pOI3UgYCX-lazarus-groups-web3-rampage

Hackmageddon cyber attacks timelines (Paolo Passeri)

CoinEX · 12/09/2023

Global cryptocurrency exchange CoinEX announces that someone hacked its hot wallets and stole large amounts of digital assets that were used to support the platform's operations. The loss is estimated in $53 million worth and the fingers are pointed to the North Korean Lazarus. [Date Occurred: 12/09/2023; Date Discovered: 12/09/2023]

https://www.hackmageddon.com/2023/11/02/1-15-september-2023-cyber-attacks-timeline/

https://www.bleepingcomputer.com/news/security/hackers-steal-53-million-worth-of-cryptocurrency-from-coinex/

Suggest a correction on GitHub