Coinis was cited in reporting on Lazarus-linked cryptocurrency exchange intrusions after attackers allegedly stole a code-signing certificate in the Coinis/WaveString breach, signed malware disguised as an OpenSSL library, and pushed malicious files through the Coinis HTS update path. Kaspersky researchers tied the activity to a Lazarus fake software company and broader financially motivated operations against cryptocurrency traders and exchanges.
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. B. Cryptocurrency. Theft of undisclosed amount of Bitcoin (possibly 2.19 million USD) in attack on Coinis. Total of 6.99M USD reported in losses from this and the April 2017 Youbit attack combined
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2017: Victim: Coinis; Date: September; Amount (USD equivalent): 2.19m; Location: ROK
Reported: 2017-09; Victims: Coinis; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: Korea, Republic of
Annex 39: Open source report on attacks on Crypto Exchanges, January 2017-September 2018 (image of Group-IB table “Successful attacks on crypto exchanges 2017-2018”, source www.group-ib.com/media/gib-crypto-summary/). Row: Date: Sept 2017; Name of Project: Coinis; Country: South Korea; Criminal group: Lazarus; Stolen in cryptocurrency: -; Stolen in USD: -. (Rows in the same table with Criminal group “Unknown” are not taken.)