AlphaPo hack — July 2023

AlphaPo, a crypto payment processor whose clients included the gambling sites Bovada and Ignition and the mystery-box platform HypeDrop, had its hot wallets emptied in July 2023. Decrypt dates the start of the drain to 22 July. On 23 July The Block reported, on ZachXBT's on-chain analysis, that at least $23 million had been taken across Ethereum, Tron and Bitcoin, with the bitcoin component still undetermined; funds taken on Ethereum were swapped for ether and bridged to Avalanche and Bitcoin. By 25 July, after ZachXBT located a further $37 million on Tron and Bitcoin, Cointelegraph put the total at over $60 million, up from an interim estimate of $31 million.

The FBI's press release of 22 August 2023 attributes "the $60 million theft of virtual currency from Alphapo" to DPRK TraderTraitor-affiliated actors, also tracked as the Lazarus Group and APT38. The release dates that theft to 22 June 2023, which matches neither the on-chain record nor contemporaneous reporting, and gives the same 22 June date for the separate CoinsPaid theft, which was reported in July. The FBI has not explained the discrepancy; the June date may refer to an earlier intrusion rather than to the drain itself.

Higher figures exist. Blockchain Intelligence Group's itemised trace of the Ethereum-side drain includes roughly 100 million FTN, which on its valuation pushes its headline total past $100 million. Independent reporting confirms that about 100.2 million FTN was among the stolen assets, alongside USDT, USDC, TFL, TRX, ETH and DAI. Most reporting excludes that token, whose nominal market value was unlikely to be realisable, which is why the recorded range runs from $60 million to $100 million.

How the wallets were compromised has never been published. AlphaPo issued no post-mortem; it told Cointelegraph that deposits and withdrawals were being reinstated at new addresses and that funds sent to old addresses would be additionally verified. No recovery, arrests or customer reimbursement has been reported.