Skip to main content
AVOID.NET

AlphaPo

avoid.net/alphapo→65/100·100% conf.
[✓ FACT-CHECKED]· reviewed once · last review 1 Nov 2026[src:defillama]

Last changed 2026-11-01 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score was recalculated from the page's findings, 58 → 65. Version history →

Why this score
Every page starts at65
Incidents it suffered (e.g. hacks)-9.6
Problems around it, caused by others-0.8
Long-running+10
Sum65
  • 2 sections set aside: the claims did not hold up in a fact-check, pending correction.

Score: 65/100 (kept between 0 and 100)

How scoring works →

Page reliability: Fact-checked 2026-11-01 · 6 of 8 claims confirmed · 2 need better sources

anchored·2vsEAm…zwbf

Summary

AlphaPo is a cryptocurrency payment processor incorporated in Panama and operating primarily in the online gambling sector, serving clients such as HypeDrop, Bovada, and Ignition. On July 22, 2023, attackers drained approximately $60 million in ETH, BTC, and TRX from its hot wallets via a private key compromise, disrupting withdrawals across multiple dependent platforms. On-chain investigator ZachXBT and subsequently the FBI attributed the attack to the DPRK-affiliated Lazarus Group (also designated TraderTraitor and APT38), placing the incident within a broader 2023 North Korean cryptocurrency theft campaign that totaled over $200 million.

Connected Entities

11 entities · 60 linked investigations
Organizations
□TraderTraitor / UNC48990□Atomic Wallet Hack0□AlphaPo□Ethereum90□Avalanche□KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□Harmony Horizon Bridge□ZachXBT
Protocols
⌂Axie Infinity
Tokens
♦Bitcoin
Relationships
  • Ethereum→mentioned with→Bitcoin(60%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Bitcoin(80%)
  • TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
  • ZachXBT→mentioned with→Bitcoin(65%)
  • TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Ethereum(80%)
  • Axie Infinity→mentioned with→Ethereum(80%)
  • North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→TraderTraitor / UNC4899(70%)
  • AlphaPo→mentioned with→Bitcoin(70%)
  • + 31 more
Have evidence about AlphaPo?

Timeline(8 events)

2018

AlphaPo Solution Inc. established as a cryptocurrency payment gateway, incorporated in Panama, serving online gambling and gaming clients.

22 July 2023

Hot wallets across Ethereum, Tron, and Bitcoin networks drained simultaneously via alleged private key compromise; initial on-chain estimates put losses at approximately $23 million.

23 July 2023

HypeDrop publicly reports inability to process BTC, ETH, and TRX deposits and withdrawals, attributing the disruption to its payment provider AlphaPo. The Block reports the connection.

25 July 2023

ZachXBT identifies an additional $37 million in BTC and TRX transactions linked to the attacker, raising the total estimated theft to $60 million and publicly attributes the attack to the Lazarus Group.

26 July 2023

BleepingComputer and Decrypt publish analyses of the hack; Halborn security firm publishes technical breakdown citing private key compromise as root cause.

22 August 2023

FBI issues official press release attributing the AlphaPo theft to DPRK TraderTraitor-affiliated actors (Lazarus Group / APT38), citing the incident as part of a 2023 campaign exceeding $200 million in stolen cryptocurrency.

23 August 2023

FBI warns cryptocurrency exchanges that DPRK may attempt to liquidate approximately 1,580 Bitcoin linked to the combined AlphaPo, CoinsPaid, and Atomic Wallet thefts.

29 November 2023

U.S. Treasury OFAC sanctions Sinbad cryptocurrency mixer, the service used to launder AlphaPo proceeds, specifically citing its role in laundering Lazarus Group hack proceeds.

Provenance & Audit Trail

Decision Log

  • #5rescore+7Recorded on Solana ✓11/1/2026, 11:20:56 PM
    slot 464274915 · hash Bh5KzjSPJXsxd62veHV5JKG9kBBKrCrDgiZbH5SG4NoA
  • #4review reviseRecorded on Solana ✓11/1/2026, 11:20:55 PM
    slot 464274910 · hash 5UHqGByB4qq7uPhAfobxjaPeBtHNGrJNvrWg81r8SwXy
  • #3reviewRecorded on Solana ✓11/1/2026, 11:20:55 PM
    slot 464274905 · hash BEcrVw3veLNn59RdMDs45hE8dJMsVq3dyfB7ozKe54Yk
  • #2rescore+48Recorded on Solana ✓10/10/2026, 6:49:27 PM
    slot 455369536 · hash J6b5G8WNhUZgC1YAD3adA6r1hXyoRFPNiCXcqrDyLRik
  • #1publishRecorded on Solana ✓5/19/2026, 9:18:06 PM
    slot 420849036 · hash 67Jtn9mUqBDe2M9F8Yh6XzRvfkT5GjSPQM2XdYMaJxE3

This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 18 of 22 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-11-018 claims checked0 corrections pending0 applied⛓ anchoredSee findings →

model: claude-sonnet-4-5

generated: 5/4/2026, 2:54:39 AM

last updated: 11/1/2026, 11:20:56 PM

8 views

avoid.net — verified advice for a post-truth world