{"investigation":{"slug":"alphapo","entity_name":"AlphaPo","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"AlphaPo is a cryptocurrency payment processor incorporated in Panama and operating primarily in the online gambling sector, serving clients such as HypeDrop, Bovada, and Ignition. On July 22, 2023, attackers drained approximately $60 million in ETH, BTC, and TRX from its hot wallets via a private key compromise, disrupting withdrawals across multiple dependent platforms. On-chain investigator ZachXBT and subsequently the FBI attributed the attack to the DPRK-affiliated Lazarus Group (also designated TraderTraitor and APT38), placing the incident within a broader 2023 North Korean cryptocurrency theft campaign that totaled over $200 million.","sections":[{"content":"AlphaPo Solution Inc. is a cryptocurrency payment gateway incorporated under the laws of the Republic of Panama (company number 155748730), with its registered agent located at Advance Tower Building, Panama City. The company was established in approximately 2018 and markets itself as a Curacao-based gateway enabling over 30 digital currencies to be accepted and converted to more than 23 fiat currencies. AlphaPo's primary market is online gambling and gaming operators. Its publicly named clients at the time of the 2023 incident included HypeDrop (mystery box platform), Bovada (sports betting), and Ignition (online poker and casino). Investigative reporting by Fintelegram and StopFrauders alleged that AlphaPo operates as a brand of the CoinsPaid group and shares managerial staff and technology with CoinsPaid, though AlphaPo has not publicly confirmed this relationship. CoinsPaid itself was separately targeted in a coordinated Lazarus Group campaign around the same period.","heading":"Background","sources":[{"url":"https://alphapo.net/","name":"","type":"other","credibility":3},{"url":"https://fintelegram.com/coinspaid-crypto-payment-processor-investor-briefing/","name":"","type":"other","credibility":3},{"url":"https://stopfrauders.org/unraveling-the-coinspaid-group-and-its-alleged-misconduct-a-closer-look-at-coinspaid-and-alphapo/","name":"","type":"other","credibility":3},{"url":"https://www.casino.org/news/gaming-operators-suffer-in-31m-hack-of-cryptocurrency-payments-platform/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 22, 2023, unauthorized actors drained AlphaPo's hot wallets across the Ethereum, Tron, and Bitcoin networks. The initial estimate of losses was approximately $23 million, covering assets including over 6 million USDT, 108,000 USDC, 100.2 million FTN (Fasttoken), 430,000 TFL (TrueFil), 2,500 ETH, and 1,700 DAI. Blockchain analyst ZachXBT subsequently identified an additional $37 million in Bitcoin and Tron transactions linked to the same attacker, raising the total estimated theft to approximately $60 million. Some on-chain analysis firms placed possible total flows even higher, though the $60 million figure is the most widely cited and was corroborated by multiple sources. The attack vector was assessed by security firm Halborn and on-chain analysts as a private key compromise rather than a smart contract exploit. The simultaneous draining of multiple independent hot wallets and the abrupt halt of platform activity were cited as indicators consistent with stolen key material. Stolen stablecoins were swapped for ETH on Ethereum before being bridged to Avalanche and subsequently to Bitcoin. On Bitcoin, funds were deposited into Sinbad, a cryptocurrency mixing service later sanctioned by the U.S. Treasury's OFAC for its documented use by the Lazarus Group. AlphaPo subsequently told users that deposits and withdrawals were being reinstated at new wallet addresses, and that funds sent to old addresses would be subject to additional verification.","heading":"The Hack","sources":[{"url":"https://cointelegraph.com/news/alphapo-payment-provider-hack-estimated-over-60m-on-chain-sleuth","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/alphapo-hot-wallets-hacked-for-over-31-million","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-alphapo-hack-july-2023","name":"","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/lazarus-hackers-linked-to-60-million-alphapo-cryptocurrency-heist/","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/241048/alphapo-hot-wallets-drained-for-23-million-hypedrop-disables-withdrawals","name":"","type":"other","credibility":3},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT was the first public source to attribute the AlphaPo theft to North Korea's Lazarus Group (also known as APT38 and designated by the FBI as TraderTraitor), citing the group's 'very distinct fingerprint on-chain.' ZachXBT noted that the on-chain behavioral patterns—including fund consolidation, cross-chain bridging methodology, and use of Sinbad mixer—were consistent with prior Lazarus operations such as the Atomic Wallet hack ($100 million, June 2023) and the Harmony Horizon Bridge hack. On August 22, 2023, the FBI formally attributed the AlphaPo theft to DPRK TraderTraitor-affiliated actors in an official press release identifying cryptocurrency funds stolen by North Korea. The FBI stated it had tracked cryptocurrency stolen by 'DPRK TraderTraitor-affiliated actors (also known as Lazarus Group and APT38)' and cited AlphaPo alongside CoinsPaid and Atomic Wallet as targets in a coordinated 2023 campaign totaling over $200 million. The FBI press release also identified approximately 1,580 Bitcoin linked to the combined thefts and warned cryptocurrency exchanges that the DPRK might attempt to liquidate these holdings. BleepingComputer noted at the time of initial reporting that it could not independently confirm Lazarus involvement beyond ZachXBT's analysis, but the subsequent FBI attribution elevated the assessment to a government-confirmed attribution.","heading":"Lazarus Attribution","sources":[{"url":"https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk","name":"","type":"other","credibility":3},{"url":"https://therecord.media/north-korea-lazarus-behind-crypto-heists","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/150282/north-korean-hacker-cell-lazarus-allegedly-behind-60m-alphapo-hack","name":"","type":"other","credibility":3},{"url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","name":"","type":"other","credibility":3},{"url":"https://www.cpomagazine.com/cyber-security/crypto-sleuth-attributes-the-alphopo-crypto-theft-to-north-korean-hackers-raises-the-amount-stolen-to-60-million/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain analysis by ZachXBT, Merkle Science, and other blockchain forensics firms traced a multi-step laundering chain following the July 22, 2023 theft. On the Ethereum network, stolen stablecoins (USDT, USDC, DAI) and other ERC-20 tokens were aggregated and swapped into approximately 3,252 ETH. Funds were then split across 67 newly created Ethereum addresses and bridged to Bitcoin via the Avalanche Bridge, which analysts noted was a lower-cost functional alternative to the previously favored Ren Bridge. Stolen Tron-network funds (over 118 million TRX tokens, approximately $9.5 million) were moved through two hops to associate addresses. On Bitcoin, the converted funds were deposited into Sinbad, a cryptocurrency mixer that the U.S. Treasury's OFAC sanctioned in November 2023 specifically for its documented role in laundering Lazarus Group proceeds, including funds from the Harmony Horizon Bridge and Axie Infinity heists. TRM Labs' on-chain data showed a spike in Sinbad volume during July and August 2023 coinciding with fund movements from the AlphaPo, CoinsPaid, and Stake.com thefts. Large quantities of TrueFil (TFL) and Fasttoken (FTN) tokens remained unmoved in the primary attacker address in the days following the hack, consistent with Lazarus Group behavior of holding illiquid assets while laundering liquid ones. The GitHub repository maintained by researcher tayvano (lazarus-bluenoroff-research) documents the AlphaPo and CoinsPaid incidents together, reflecting analyst assessment that both attacks were part of a single coordinated campaign.","heading":"On-Chain Evidence","sources":[{"url":"https://www.merklescience.com/blog/hack-track-alphapo-flow-of-funds-analysis","name":"","type":"other","credibility":3},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"","type":"other","credibility":3},{"url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/alphapo_coinspaid.md","name":"","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","name":"","type":"other","credibility":3},{"url":"https://www.scorechain.com/blog/alphapo-hack-now-estimated-at-over-60m","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Because AlphaPo serves as the crypto payment processing layer for several online gambling and gaming platforms, the July 22, 2023 hack had immediate downstream effects on its clients. HypeDrop, a mystery box platform, publicly announced it was experiencing problems specifically related to BTC, ETH, and TRX withdrawals and ETH and TRX deposits, attributing the disruption to its provider. HypeDrop subsequently disabled crypto withdrawal functionality while AlphaPo worked to restore operations. Bovada and Ignition, both online gambling platforms, similarly experienced hampered crypto withdrawal processing. AlphaPo communicated that operations were being restored using new wallet addresses and asked users who had sent funds to old addresses to undergo additional verification, introducing uncertainty for those users. The Block reported the connection between HypeDrop's disruption and the AlphaPo hot wallet drain on July 23, 2023. Casino.org reported that gaming operators broadly suffered from the incident. No public statements were made by Bovada or Ignition specifically confirming losses or user fund shortfalls attributable to the AlphaPo incident.","heading":"Impact on Clients","sources":[{"url":"https://www.theblock.co/post/241048/alphapo-hot-wallets-drained-for-23-million-hypedrop-disables-withdrawals","name":"","type":"other","credibility":3},{"url":"https://www.casino.org/news/gaming-operators-suffer-in-31m-hack-of-cryptocurrency-payments-platform/","name":"","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=alphapo-hack","name":"","type":"other","credibility":3},{"url":"https://beincrypto.com/alphapo-hot-wallet-hack/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"AlphaPo presents a critical risk profile for any entity considering using its payment processing services. The July 2023 incident demonstrated a fundamental failure in key management: storing private keys for hot wallets in a manner susceptible to exfiltration, without multi-signature controls that would have required multiple parties to authorize withdrawals. The scale of the compromise—simultaneous draining across Ethereum, Tron, and Bitcoin hot wallets—indicates either a systemic key management failure or a deeply embedded threat actor with prolonged access. The FBI's formal attribution to a nation-state adversary (DPRK/Lazarus Group) places AlphaPo within a documented pattern of sophisticated, long-dwell-time intrusions rather than opportunistic attacks. AlphaPo's alleged operational and managerial overlap with CoinsPaid, which was separately targeted in the same Lazarus campaign, raises additional concerns about shared infrastructure vulnerabilities. No publicly verified criminal charges, regulatory sanctions, or civil litigation against AlphaPo or its principals have been identified. The company itself has not published a post-incident security audit or remediation report in any publicly accessible venue. For downstream clients—particularly gambling platforms—reliance on AlphaPo exposes their users to the risk of payment suspension without notice during any future security incident. The trust score of 10/100 reflects the severity of the confirmed hack, the nation-state attribution, the lack of transparent post-incident disclosure, and the structural risk to client platforms.","heading":"Risk Assessment","sources":[{"url":"https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-alphapo-hack-july-2023","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/252081/humans-remain-weakest-link-coinspaid-ceo-lazarus-group-hack","name":"","type":"other","credibility":3},{"url":"https://stopfrauders.org/unraveling-the-coinspaid-group-and-its-alleged-misconduct-a-closer-look-at-coinspaid-and-alphapo/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018","event":"AlphaPo Solution Inc. established as a cryptocurrency payment gateway, incorporated in Panama, serving online gambling and gaming clients.","source":"","date_original":"2018-01-01"},{"date":"2023-07-22","event":"Hot wallets across Ethereum, Tron, and Bitcoin networks drained simultaneously via alleged private key compromise; initial on-chain estimates put losses at approximately $23 million.","source":""},{"date":"2023-07-23","event":"HypeDrop publicly reports inability to process BTC, ETH, and TRX deposits and withdrawals, attributing the disruption to its payment provider AlphaPo. The Block reports the connection.","source":""},{"date":"2023-07-25","event":"ZachXBT identifies an additional $37 million in BTC and TRX transactions linked to the attacker, raising the total estimated theft to $60 million and publicly attributes the attack to the Lazarus Group.","source":""},{"date":"2023-07-26","event":"BleepingComputer and Decrypt publish analyses of the hack; Halborn security firm publishes technical breakdown citing private key compromise as root cause.","source":""},{"date":"2023-08-22","event":"FBI issues official press release attributing the AlphaPo theft to DPRK TraderTraitor-affiliated actors (Lazarus Group / APT38), citing the incident as part of a 2023 campaign exceeding $200 million in stolen cryptocurrency.","source":""},{"date":"2023-08-23","event":"FBI warns cryptocurrency exchanges that DPRK may attempt to liquidate approximately 1,580 Bitcoin linked to the combined AlphaPo, CoinsPaid, and Atomic Wallet thefts.","source":""},{"date":"2023-11-29","event":"U.S. Treasury OFAC sanctions Sinbad cryptocurrency mixer, the service used to launder AlphaPo proceeds, specifically citing its role in laundering Lazarus Group hack proceeds.","source":""}],"sources_used":[{"url":"https://alphapo.net/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260225032127/https://alphapo.net/","credibility":3,"archive_timestamp":"2026-02-25T03:21:27+00:00"},{"url":"https://fintelegram.com/coinspaid-crypto-payment-processor-investor-briefing/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260516112106/https://fintelegram.com/coinspaid-crypto-payment-processor-investor-briefing/","credibility":3,"archive_timestamp":"2026-05-16T11:21:06+00:00"},{"url":"https://stopfrauders.org/unraveling-the-coinspaid-group-and-its-alleged-misconduct-a-closer-look-at-coinspaid-and-alphapo/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251119034803/https://stopfrauders.org/unraveling-the-coinspaid-group-and-its-alleged-misconduct-a-closer-look-at-coinspaid-and-alphapo/","credibility":3,"archive_timestamp":"2025-11-19T03:48:03+00:00"},{"url":"https://www.casino.org/news/gaming-operators-suffer-in-31m-hack-of-cryptocurrency-payments-platform/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829144900/https://www.casino.org/news/gaming-operators-suffer-in-31m-hack-of-cryptocurrency-payments-platform/","credibility":3,"archive_timestamp":"2026-08-29T14:49:00+00:00"},{"url":"https://cointelegraph.com/news/alphapo-payment-provider-hack-estimated-over-60m-on-chain-sleuth","name":"","type":"other","archive_url":"http://web.archive.org/web/20251118161922/https://cointelegraph.com/news/alphapo-payment-provider-hack-estimated-over-60m-on-chain-sleuth","credibility":3,"archive_timestamp":"2025-11-18T16:19:22+00:00"},{"url":"https://cointelegraph.com/news/alphapo-hot-wallets-hacked-for-over-31-million","name":"","type":"other","archive_url":"http://web.archive.org/web/20251202183911/https://cointelegraph.com/news/alphapo-hot-wallets-hacked-for-over-31-million","credibility":3,"archive_timestamp":"2025-12-02T18:39:11+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-alphapo-hack-july-2023","name":"","type":"other","archive_url":"http://web.archive.org/web/20260517000952/https://www.halborn.com/blog/post/explained-the-alphapo-hack-july-2023","credibility":3,"archive_timestamp":"2026-05-17T00:09:52+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/lazarus-hackers-linked-to-60-million-alphapo-cryptocurrency-heist/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260503181646/https://www.bleepingcomputer.com/news/security/lazarus-hackers-linked-to-60-million-alphapo-cryptocurrency-heist/","credibility":3,"archive_timestamp":"2026-05-03T18:16:46+00:00"},{"url":"https://www.theblock.co/post/241048/alphapo-hot-wallets-drained-for-23-million-hypedrop-disables-withdrawals","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"","type":"other","archive_url":"http://web.archive.org/web/20260512211804/https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","credibility":3,"archive_timestamp":"2026-05-12T21:18:04+00:00"},{"url":"https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk","name":"","type":"other","archive_url":"http://web.archive.org/web/20260720154551/https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk","credibility":3,"archive_timestamp":"2026-07-20T15:45:51+00:00"},{"url":"https://therecord.media/north-korea-lazarus-behind-crypto-heists","name":"","type":"other","archive_url":"http://web.archive.org/web/20260411121619/https://therecord.media/north-korea-lazarus-behind-crypto-heists","credibility":3,"archive_timestamp":"2026-04-11T12:16:19+00:00"},{"url":"https://decrypt.co/150282/north-korean-hacker-cell-lazarus-allegedly-behind-60m-alphapo-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260419081117/https://decrypt.co/150282/north-korean-hacker-cell-lazarus-allegedly-behind-60m-alphapo-hack","credibility":3,"archive_timestamp":"2026-04-19T08:11:17+00:00"},{"url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260829142141/https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","credibility":3,"archive_timestamp":"2026-08-29T14:21:41+00:00"},{"url":"https://www.cpomagazine.com/cyber-security/crypto-sleuth-attributes-the-alphopo-crypto-theft-to-north-korean-hackers-raises-the-amount-stolen-to-60-million/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.merklescience.com/blog/hack-track-alphapo-flow-of-funds-analysis","name":"","type":"other","archive_url":"http://web.archive.org/web/20260423042930/https://www.merklescience.com/blog/hack-track-alphapo-flow-of-funds-analysis","credibility":3,"archive_timestamp":"2026-04-23T04:29:30+00:00"},{"url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/alphapo_coinspaid.md","name":"","type":"other","archive_url":"http://web.archive.org/web/20260819063002/https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/alphapo_coinspaid.md","credibility":3,"archive_timestamp":"2026-08-19T06:30:02+00:00"},{"url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","name":"","type":"other","archive_url":"http://web.archive.org/web/20260511085148/https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","credibility":3,"archive_timestamp":"2026-05-11T08:51:48+00:00"},{"url":"https://www.scorechain.com/blog/alphapo-hack-now-estimated-at-over-60m","name":"","type":"other","archive_url":"http://web.archive.org/web/20260410230803/https://www.scorechain.com/blog/alphapo-hack-now-estimated-at-over-60m","credibility":3,"archive_timestamp":"2026-04-10T23:08:03+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=alphapo-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260612074328/https://www.web3isgoinggreat.com/?id=alphapo-hack","credibility":3,"archive_timestamp":"2026-06-12T07:43:28+00:00"},{"url":"https://beincrypto.com/alphapo-hot-wallet-hack/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/252081/humans-remain-weakest-link-coinspaid-ceo-lazarus-group-hack","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:39.926467+00:00","updated_at":"2026-08-30T05:14:10.599878+00:00"}}