CoinEx hack
About $70M was drained from the Hong Kong-based exchange CoinEx in September 2023 after its hot-wallet private keys were compromised. Researchers (Elliptic, ZachXBT) linked the theft to North Korea's Lazarus Group, partly via wallets shared with the Stake.com hack.
Also known as: CoinEx, CoinEx hack
Summary
On September 12, 2023, CoinEx detected anomalous withdrawals from several hot wallets and ultimately lost an estimated $70 million across BTC, ETH, XRP, TRON, SOL, and other assets. The exchange said the root cause was a compromised hot-wallet private key, that cold storage was unaffected, and that it would compensate users 100%. [1][2]
Attribution
Blockchain investigators linked the theft to North Korea's Lazarus Group: ZachXBT found the attacker reused addresses connected to the earlier $41M Stake.com hack, and Elliptic noted the funds moved through a bridge Lazarus had used before. It was described as Lazarus's fifth major heist in about three months in 2023. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
