Alphapo & CoinsPaid hack
Two linked crypto payment processors were drained in mid-2023 — about $60M from Alphapo and ~$37M from CoinsPaid — via compromised hot-wallet keys. The FBI attributed both thefts to North Korea's Lazarus Group (TraderTraitor); CoinsPaid said it was breached after months of social-engineering.
Also known as: Alphapo, CoinsPaid, Alphapo hack, CoinsPaid hack
Summary
In July 2023, the affiliated cryptocurrency payment processors Alphapo and CoinsPaid were hacked in quick succession. On-chain analysts (ZachXBT) put Alphapo's losses around $60 million and CoinsPaid's at about $37 million, drained from hot wallets — likely via leaked or stolen private keys. [1][2]
Attribution and method
The FBI attributed the Alphapo (~$60M) and CoinsPaid (~$37M) thefts, along with the June 2023 Atomic Wallet hack (~$100M), to North Korea's "TraderTraitor"-affiliated actors (also known as Lazarus Group / APT38). CoinsPaid said attackers had surveilled it for roughly six months and used a social-engineering lure (a fake job offer) to gain access — a hallmark DPRK technique. Proceeds were laundered through bridges and mixers such as Sinbad. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
