CoinEx hack — September 2023

CoinEx is a centralised cryptocurrency exchange. On 12 September 2023 its risk-control system flagged withdrawals it had not authorised from several hot wallet addresses used to hold user assets for day-to-day liquidity. CoinEx said the cause was the leakage of a hot wallet private key. Its incident page lists losses across more than twenty assets, including 231 BTC, 4,953 ETH, 135,600 SOL, 12,625,364 XRP, 16,695,400 DOGE and 137,127,860 TRX, and states that the specific values were still being liquidated.

Estimates of the total have never converged. Cointelegraph reported the loss was first estimated at about $27 million and roughly doubled over the following week; Elliptic used approximately $54 million while noting the total was not yet known. CoinEx's own estimate within the week of the incident was roughly $70 million, the figure the UN Panel of Experts on North Korea later recorded. In a statement published on 25 June 2026, CoinEx put the loss at approximately $80 million.

CoinEx suspended withdrawals, moved remaining assets from the compromised hot wallet to secure addresses on 12 September, rebuilt its wallet architecture between 14 and 21 September with new deposit addresses for every user, and resumed deposits and withdrawals for ten mainstream assets including BTC, ETH, USDT and USDC on 21 September 2023. It said user assets had not been affected and that its User Asset Security Foundation would bear the loss.

Elliptic found that some of the stolen funds went to an address previously used to launder proceeds of the Stake.com theft, were bridged to Ethereum using a bridge Lazarus had used before, and returned to an address controlled by the CoinEx attacker. It concluded Lazarus should be suspected. CoinEx has since said the attack was attributed by multiple investigations to a North Korea-affiliated group. No one has been charged.