LCX hack — January 2022
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | January 9, 2022 |
| Target type | Centralised exchange |
| Loss | $7,940,000Published estimates range $5,330,000 to $7,940,000Price at time of incident |
| Method | Private key compromiseUnauthorised transfers out of a single LCX-controlled Ethereum hot wallet. LCX has never publicly disclosed how the wallet was compromised; its incident report says only that assets 'were moved out of one LCX Ethereum wallet by an unauthorized party' and that other hot wallets and customer data were unaffected. |
| Chains | Ethereum |
| Outcome | Users reimbursed |
What happened
On 8 January 2022, between 23:23 and 23:37 CET, an unauthorised party moved crypto assets out of a single Ethereum hot wallet operated by LCX AG, a Liechtenstein-registered exchange. LCX's own incident report itemises the loss at approximately $7.94 million: 3,437,783 USDC, 17,251,192 LCX tokens (valued by LCX at about $2.47 million), 761,237 EURe, 162.68 ETH, 101,250 SAND, 669 QNT, 1,848 LINK, 4,820 ENJ and 4.76 MKR. LCX has never described how the wallet was compromised.
The figure is disputed. PeckShield, which first flagged the outflows, put the loss at about $6.8 million. TRM Labs' on-chain reconstruction put it at roughly $5.33 million. The lower estimates diverge from LCX's mainly on how the exchange's own thinly traded LCX token is valued. TRM reports that the attacker converted the stolen tokens to ETH within about 45 minutes and had deposited the proceeds into Tornado Cash by 23:12 GMT, splitting them across the 100, 10 and 1 ETH pools.
LCX said it would cover the loss from its own funds, that user balances were unaffected, and it reopened deposits and withdrawals on 28 January 2022. Working with police in Liechtenstein, Ireland, Spain and the United States, LCX says roughly 60% of the stolen value was frozen, including 500 ETH held at Coinbase Europe under a Liechtenstein court order and 1,274,249 USDC blacklisted by Centre Consortium after a New York Supreme Court order. In June 2022 the same court allowed LCX to serve a temporary restraining order on the anonymous defendants by airdropping an NFT to the wallet holding the stolen assets. No perpetrator has been identified.
Law enforcement
Liechtenstein, Irish, Spanish and US authorities. A Liechtenstein court order served through Irish law enforcement froze 500 ETH at Coinbase Europe; a New York Supreme Court order led Centre Consortium to blacklist 1,274,249 USDC. LCX AG v. John Does 1-25 was filed in the Supreme Court of the State of New York on 1 June 2022.
Sources
- LCX AGPrimary · retrieved 2026-08-01
- LCX AGPrimary · retrieved 2026-08-01
- CointelegraphSecondary · retrieved 2026-08-01
- TRM LabsSecondary · retrieved 2026-08-01
Official post-mortem: https://www.lcx.com/hot-wallet-incident-report/
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "LCX hack — January 2022", iTokenly, accessed 2026-08-01, https://itokenly.com/hacks/lcxhttps://itokenly.com/hacks/lcxPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.