Edit: Phemex hack — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

> **On attribution:** The North Korea / Lazarus attribution comes from on-chain analysts (ZachXBT, Arkham) and security firms based on shared infrastructure and laundering patterns; Phemex did not publicly attribute the attack. Cyber-attribution is rarely 100% certain.

## Summary

On January 23, 2025, Phemex — a centralized exchange based in Singapore — suffered an access-control breach that let attackers manually drain its hot wallets across roughly 16 blockchains. Initial estimates of ~$29M rose to $73–85M as more transactions were identified. [1][2]

## Tactics and attribution

The attackers swapped freezable assets for non-freezable ones and routed funds through mixers (e.g. Tornado Cash), starting with the most valuable tokens — a pattern security firms associate with North Korea. In February 2025, ZachXBT showed the Phemex theft address commingled funds directly with the $1.4B Bybit hack (and later the BingX hack), tying all three to the Lazarus Group. [2][3]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit