North Korean hacking group 'Lazarus' targeted cryptocurrency payments platform CoinsPaid on 22 July 2023 · 22.07.2023
The North Korean state-backed hacking group 'Lazarus' is suspected of having targeted cryptocurrency payments platform CoinsPaid on 22 July 2023, the company disclosed on 26 July.
The incident led the platform, which runs a payment system to support businesses in the use of cryptocurrencies, to shut down for four days. Lazarus is assessed to have siphoned off $37.3 million in company assets during the theft, which reportedly did not affect client funds. Incident analysis shared by CoinsPaid identified the intrusion as a hybrid attack combining social engineering, bribery of critical personnel, and intrusion attempts against numerous internet-accessible applications.
On 22 August 2023, the FBI warned cryptocurrency companies of a possible USD 40 million transfer of cryptocurrencies by North Korean TraderTraitor-affiliated actors, also known as Lazarus, which are linked to cyberattacks on cryptocurrency companies. In the same warning, the FBI also attributed the cyber incident on cryptocurrency companies Alphapo, CoinsPaid and AtomicWallet to the Lazarus hacking group.
Sources cited by EuRepoC (22)
Show 17 more
CoinsPaid blames Lazarus hackers for theft of $37,300,000 in crypto · 2023-07
CoinsPaid blames Lazarus hackers for theft of $37,300,000 in crypto
https://www.bleepingcomputer.com/news/security/coinspaid-blames-lazarus-hackers-for-theft-of-37-300-000-in-crypto/
Targeting of CoinsPaid cryptocurrency service · Jul 2023
CoinsPaid, a cryptocurrency management firm, was hacked by the North Korean threat actor Lazarus Group. Lazarus managed to steal almost $38 million in various kinds of cryptocurrency.
CoinsPaid · June 22, 2023
...the $37 million theft of virtual currency from CoinsPaid on June 22, 2023
Alphapo and CoinsPaid · on or about July 22, 2023
In 2023 alone, DPRK cyber actors have stolen more than $200 million. This amount includes, but is not limited to, approximately $60 million of virtual currency from Alphapo and CoinsPaid on or about July 22, 2023
31st July – Threat Intelligence Report · 2023-07-31
Estonian crypto-payments service provider CoinsPaid has announced that it experienced a cyber-attack on July 22nd that resulted in the theft of $37,200,000 worth of cryptocurrency. CoinsPaid is blaming the attack on the North Korean hacking group Lazarus.
CoinsPaid theft · June 2023
In June 2023, North Korean hackers stole approximately $60 million in virtual currency from Alphapo, a centralized virtual currency payment provider, and approximately $37 million in virtual currency from CoinsPaid, another virtual currency payment platform. [Case No. 2:24-cv-04640, U.S. District Court for the Central District of California; filing: COMPLAINT No Fee Required - US Government, filed by plaintiff UNITED STATES OF AMERICA.]
CoinsPaid theft (Estonian company) · on or about July 22, 2023
Then, in or around July 2023, North Korean cyber actors stole approximately $37 million in virtual currency from CoinsPaid, an Estonian company ... on or about July 22, 2023, North Korean hackers stole approximately $101 million in virtual currency from Alphapo and approximately $37 million in virtual currency from CoinsPaid. [Case No. 1:25-cv-03771, U.S. District Court for the District of Columbia; filing: COMPLAINT against APPROXIMATELY 1,159,834.52 USDT]
CoinsPaid hot wallet theft via social engineering (July 22nd 2023) · Sep 15, 2023
On July 22nd 2023, Lazarus gained access to hot wallets belonging to crypto payment platform CoinsPaid via a successful social engineering attack. This access allowed the attackers to create authorized requests to withdraw approximately $37.3 million in crypto assets from the platform's hot wallets.
CoinsPaid breach · published 2023-09-13
CertiK has identified transactions connecting the Atomic Wallet, Alphapo, CoinsPaid, Stake.com, and CoinEx breaches, serving as on-chain evidence of Lazarus Group's involvement.
Alphapo, CoinsPaid and Atomic Wallet thefts · June 22, 2023; June 22, 2023; June 2, 2023
The DPRK TraderTraitor-affiliated actors were responsible for several high-profile international cryptocurrency heists to include the $60 million theft of virtual currency from Alphapo on June 22, 2023; the $37 million theft of virtual currency from CoinsPaid on June 22, 2023; and the $100 million theft of virtual currency from Atomic Wallet on June 2, 2023.