Phemex hack

On attribution: The North Korea / Lazarus attribution comes from on-chain analysts (ZachXBT, Arkham) and security firms based on shared infrastructure and laundering patterns; Phemex did not publicly attribute the attack. Cyber-attribution is rarely 100% certain.

Summary

On January 23, 2025, Phemex — a centralized exchange based in Singapore — suffered an access-control breach that let attackers manually drain its hot wallets across roughly 16 blockchains. Initial estimates of ~$29M rose to $73–85M as more transactions were identified. ^[1][2]

Tactics and attribution

The attackers swapped freezable assets for non-freezable ones and routed funds through mixers (e.g. Tornado Cash), starting with the most valuable tokens — a pattern security firms associate with North Korea. In February 2025, ZachXBT showed the Phemex theft address commingled funds directly with the $1.4B Bybit hack (and later the BingX hack), tying all three to the Lazarus Group. ^[2][3]

Bracketed numbers refer to the numbered sources listed below.