Stake.com hack
About $41M was stolen from the crypto casino Stake.com on September 4, 2023, after attackers obtained access to its hot wallets (ETH, BNB Chain, Polygon). The FBI publicly attributed the theft to North Korea's Lazarus Group (APT38).
Also known as: Stake.com, Stake, Stake hack
Summary
On September 4, 2023, the online casino and betting platform Stake.com lost about $41 million when attackers drained funds from its hot wallets on the Ethereum, BNB Chain, and Polygon networks (roughly $15.7M in ETH and ~$25.6M across BSC/Polygon, per ZachXBT). The cause appeared to be a leaked or stolen hot-wallet private key rather than a contract bug. [1][2]
Attribution
On September 6, 2023, the FBI confirmed the theft and attributed it to the Lazarus Group (APT38), noting the same DPRK actors were responsible for ~$200M+ in 2023 crypto thefts, including Alphapo, CoinsPaid, and Atomic Wallet. The funds were laundered through mixers such as Sinbad/YoMix. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
