KuCoin hack
About $281M in crypto was stolen from the Singapore-based exchange KuCoin in September 2020 after attackers obtained hot-wallet private keys. Chainalysis attributed the theft to North Korea's Lazarus Group; KuCoin recovered roughly 84% of the assets.
Also known as: KuCoin, KuCoin hack
Summary
In September 2020, attackers drained roughly $281 million in cryptocurrency from the exchange KuCoin — one of the largest exchange thefts to that point. KuCoin's CEO said the attackers had obtained the private keys to the exchange's hot wallets. [1][2]
Attribution and recovery
Blockchain-analysis firm Chainalysis attributed the hack to the Lazarus Group, a North Korea-linked actor, based in part on a recognizable laundering pattern. KuCoin said it ultimately recovered about 84% (~$236 million) of the stolen funds through on-chain tracking, contract upgrades and token freezes by project teams, and law-enforcement cooperation, and covered the remainder via its insurance fund. [1][2][3]
Bracketed numbers refer to the numbered sources listed below.
Sources (3)
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
