{"investigation":{"slug":"atomic-wallet","entity_name":"Atomic Wallet","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"draft","content_type":"investigation","summary":"Atomic Wallet is a non-custodial, multi-currency cryptocurrency wallet founded in 2017 and headquartered in Tallinn, Estonia. In June 2023, attackers attributed to North Korea's Lazarus Group (TraderTraitor) stole approximately $100 million in cryptocurrency from an estimated 5,500 user wallets in one of the largest crypto theft events of that year. Prior to the hack, an independent security firm had publicly disclosed unresolved critical vulnerabilities in the wallet's cryptography implementation as early as February 2022, and Atomic Wallet did not adequately address those findings before the breach occurred.","sections":[{"content":"Atomic Wallet is a non-custodial cryptocurrency wallet application launched in 2017. The company is registered in Tallinn, Estonia, and was co-founded by Konstantin Gladych, who also co-founded the Changelly cryptocurrency exchange. Gladych holds a Ph.D. in data analysis and processing. The wallet supports hundreds of cryptocurrencies and is available on Windows, macOS, Linux, iOS, and Android. In 2018, Atomic Wallet raised approximately $22 million through an initial coin offering (ICO) for its native AWC token. As a non-custodial wallet, Atomic Wallet does not hold user private keys — keys are generated and stored locally on user devices. However, this architecture did not prevent the June 2023 breach, in which private keys belonging to thousands of users were compromised by an unknown mechanism.","heading":"Background","sources":[{"url":"https://www.crunchbase.com/organization/atomic-wallet","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"In April 2021, the independent security firm Least Authority completed an audit of Atomic Wallet and identified multiple critical vulnerabilities. The findings were disclosed publicly in February 2022 after approximately ten months of responsible disclosure attempts. Least Authority documented four primary categories of concern: (1) flawed cryptographic implementation that placed users at risk of total loss of funds; (2) failure to follow wallet system design and development best practices; (3) insufficient project documentation; and (4) improper use of the Electron desktop application framework, including outdated and unmaintained dependencies. Least Authority's published conclusion stated that 'the design and implementation of the Atomic Wallet system does not sufficiently demonstrate considerations for security and places current users of the wallet at significant risk,' and strongly advised against wallet deployment until issues were remediated. Atomic Wallet responded that none of the identified issues posed security risks because it is a non-custodial wallet. The company indicated it expected to implement Least Authority's suggestions in Q2 2022 and conduct a re-audit. The subsequent class action lawsuit alleged that Atomic Wallet and CEO Konstantin Gladych were aware of security vulnerabilities 'since at least as early as 2022' and failed to implement necessary safeguards. Security researcher Taylor Monahan publicly criticized the company for failing to act on audit findings for over a year before the breach.","heading":"Prior Security Warnings (2021–2022)","sources":[{"url":"https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/atomic-wallet-slammed-for-closed-code-amid-35m-dollar-hack/","name":"","type":"other","credibility":3},{"url":"https://topclassactions.com/lawsuit-settlements/privacy/data-breach/atomic-wallet-knew-of-security-flaws-prior-to-breach-class-action-claims/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On approximately June 2–3, 2023, attackers began draining cryptocurrency from Atomic Wallet users. The company initially acknowledged 'reports of wallets being compromised' on June 3, 2023. Early estimates placed losses at approximately $35 million; subsequent blockchain analysis by Elliptic raised the total to over $100 million across approximately 5,000 to 5,500 compromised wallets. Atomic Wallet stated that fewer than 1% of its monthly active users were affected. The attack vector has never been publicly confirmed. Atomic Wallet itself listed four 'most probable' causes: a virus on user devices, an infrastructure breach, a man-in-the-middle attack, or malware code injection. Independent researchers suggested additional possibilities including insufficient entropy in key generation, fault attacks on key-related algorithms, use of an outdated vulnerable dependency in the Android version, or private keys being inadvertently transmitted to a centralized server through logs or monitoring mechanisms. The root cause was never officially disclosed. Blockchain analytics firms Elliptic and TRM Labs attributed the attack to North Korea's Lazarus Group (also known as APT38 and TraderTraitor) based on the laundering patterns and infrastructure used. The FBI subsequently confirmed that approximately $100 million in virtual currency was stolen from Atomic Wallet on or about June 2, 2023, and attributed this to DPRK cyber actors.","heading":"The Lazarus Group Attack (June 2023)","sources":[{"url":"https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/144444/north-korean-hackers-pocket-over-100-m-in-atomic-wallet-heist","name":"","type":"other","credibility":3},{"url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain analytics firm Elliptic conducted detailed on-chain tracing of the stolen assets and published findings in multiple reports. According to Elliptic, stolen funds were initially swapped for Bitcoin using on-chain trading tools including 1inch. The Bitcoin was then routed through Sinbad.io, a Bitcoin mixer (tumbler) service. Elliptic assessed Sinbad.io to be a likely rebranded version of Blender.io, which was the first cryptocurrency mixer sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) due to its use by North Korea. Lazarus Group had previously used Sinbad.io to launder funds from the $540 million Axie Infinity hack and the $100 million Harmony Horizon Bridge attack. In a subsequent laundering phase, attackers shifted funds through Garantex, a Russia-based cryptocurrency exchange sanctioned by OFAC in April 2022 for facilitating transactions linked to ransomware and darknet markets. Garantex had processed over $100 million in transactions associated with illicit actors. Elliptic assessed that the process of laundering followed exactly the same sequence of steps previously documented for Lazarus Group operations, and that Lazarus attribution carried a high level of confidence. The FBI confirmed DPRK actor involvement in a public advisory. Elliptic and its exchange partners succeeded in freezing over $1 million in stolen assets through coordination with exchanges worldwide.","heading":"On-Chain Evidence","sources":[{"url":"https://www.elliptic.co/blog/analysis/35-million-atomic-wallet-hacker-funnels-crypto-to-north-korea-s-favored-mixer","name":"","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2023/06/13/atomic-wallet-hackers-move-stolen-funds-via-ofac-sanctioned-exchange-garantex-elliptic","name":"","type":"other","credibility":3},{"url":"https://www.trmlabs.com/resources/blog/inside-north-koreas-crypto-heists","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"According to Elliptic's analysis, over $100 million in cryptocurrency was stolen across approximately 5,000 to 5,500 user wallets. The average loss per affected user was approximately $2,800. At least ten wallet addresses each lost more than $1 million, and at least 164 addresses lost more than $100,000. Atomic Wallet characterized the affected wallets as representing less than 1% of its monthly active users. Multiple affected users reported losing their entire cryptocurrency portfolios. Chainalysis listed the Atomic Wallet exploit among the largest individual crypto hacks of 2023 in its annual crypto crime report. Over $1 million in stolen assets were frozen by exchanges in coordination with Elliptic and other investigators, but the vast majority of the stolen funds were not recovered. The FBI confirmed in an August 2023 advisory that approximately $100 million in virtual currency was stolen from Atomic Wallet on or about June 2, 2023.","heading":"User Losses","sources":[{"url":"https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"","type":"other","credibility":3},{"url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2024/","name":"","type":"other","credibility":3},{"url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On June 21, 2023, plaintiffs Robert Meany and Graham Dickinson filed a class action lawsuit in the U.S. District Court for the District of Colorado (Case No. 1:23-cv-01582), captioned Meany et al. v. Atomic Wallet et al. The defendants named included Atomic Wallet and CEO Konstantin Gladych. The complaint alleged negligence, specifically that the defendants knew of critical security vulnerabilities identified by Least Authority since at least April 2021, failed to implement the recommended safeguards, and failed to protect user funds and private key data. On September 10, 2024, U.S. District Judge Philip Brimmer granted the defendants' motion to dismiss for lack of personal jurisdiction. The court found that plaintiffs had not demonstrated that Atomic Wallet or its principals had intentionally directed their operations at Colorado, and that marketing an application available for download nationwide and communicating with a Colorado-based customer support user did not constitute sufficient purposeful availment of Colorado law. The court denied plaintiffs' request to amend the complaint. Judge Brimmer did grant plaintiffs an additional 21 days to demonstrate why the case against defendant Ilia Brusov — a shareholder and founder of Evercode Infinite — should not also be dismissed. As of the dismissal ruling, affected users had no confirmed ongoing legal avenue in U.S. courts to recover losses.","heading":"Legal Proceedings","sources":[{"url":"https://www.classaction.org/news/class-action-filed-over-2023-atomic-wallet-data-breach-in-which-100m-in-crypto-assets-was-stolen","name":"","type":"other","credibility":3},{"url":"https://brownrudnick.com/client_news/brown-rudnick-wins-dismissal-of-class-action-suit-against-atomic-wallet-over-100m-hack/","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/us-court-dismiss-atomic-wallet-class-suit-lack-jurisdiction","name":"","type":"other","credibility":3},{"url":"https://www.insideclassactions.com/2024/10/08/a-closer-look-court-applies-established-personal-jurisdiction-principles-to-dismiss-crypto-wallet-companies-in-class-action-filed-after-100-million-north-korean-crypto-hack/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Atomic Wallet presents several categories of unresolved risk for prospective users. First, the root cause of the June 2023 breach was never publicly disclosed by the company, leaving users unable to confirm that the underlying vulnerability was remediated. Second, independent auditor Least Authority had identified critical security deficiencies as early as April 2021, and the company's response prior to the breach was characterized by affected users and security researchers as inadequate. Third, the company's claim that fewer than 1% of users were affected, while mathematically accurate if taken at face value, corresponds to thousands of individuals who lost crypto assets — in many cases their entire holdings — with no recovery mechanism and no successful legal remedy as of 2024. Fourth, the Lazarus Group's attribution to a nation-state actor (DPRK) means that the perpetrators remain active and face no realistic extradition or prosecution risk. Fifth, the class action dismissal on jurisdictional grounds means that victims have no established legal path to compensation in U.S. courts. Atomic Wallet has continued to operate following the incident. Users who retained assets in Atomic Wallet wallets through and after the breach should be aware that the company has not confirmed the attack vector or provided a public technical post-mortem.","heading":"Risk Assessment","sources":[{"url":"https://hacken.io/discover/atomic-wallet-hack/","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/atomic-wallet-faces-lawsuit-following-north-korean-hack/","name":"","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-04","event":"Least Authority delivers security audit to Atomic Wallet identifying critical vulnerabilities, including cryptography flaws capable of causing total user fund loss.","source":"","date_original":"2021-04-01"},{"date":"2021-11","event":"Atomic Wallet provides partial updates; Least Authority finds a significant number of issues remain unresolved.","source":"","date_original":"2021-11-01"},{"date":"2022-02-10","event":"Least Authority publicly discloses unresolved Atomic Wallet security risks — the first such disclosure in the firm's 11-year history — after responsible disclosure attempts go unaddressed.","source":""},{"date":"2023-06-02","event":"Hack begins: DPRK TraderTraitor-affiliated actors (Lazarus Group) begin draining Atomic Wallet user wallets. An estimated 5,500 wallets are ultimately compromised.","source":""},{"date":"2023-06-03","event":"Atomic Wallet publicly acknowledges the security incident via its official blog, stating it is investigating. No root cause is disclosed.","source":""},{"date":"2023-06-06","event":"Elliptic publicly attributes the Atomic Wallet hack to North Korea's Lazarus Group and begins tracing stolen funds on-chain.","source":""},{"date":"2023-06-13","event":"Total losses confirmed to exceed $100 million by blockchain analytics firms, making it one of the largest crypto hacks of 2023.","source":""},{"date":"2023-06","event":"Elliptic reports hackers routing stolen funds through OFAC-sanctioned Russian exchange Garantex and then through Sinbad.io mixer to obfuscate trails.","source":"","date_original":"2023-06-01"},{"date":"2023-08-23","event":"FBI issues press release identifying DPRK TraderTraitor actors as responsible for the $100 million Atomic Wallet theft, as well as simultaneous heists against Alphapo and CoinsPaid.","source":""},{"date":"2023-09","event":"Class action lawsuit Meany et al. v. Atomic Wallet filed in U.S. District Court for the District of Colorado (case 1:23-cv-01582).","source":"","date_original":"2023-09-01"},{"date":"2024-09-10","event":"U.S. District Judge Philip Brimmer dismisses the Colorado class action for lack of personal jurisdiction. Motion to amend also denied.","source":""},{"date":"2025-06-05","event":"A new proposed class action, Petru Alasu et al. v. Atomic Protocol Systems dba Atomic Wallet, filed in the U.S. District Court for the Northern District of California, continuing legal pressure on the company.","source":""}],"sources_used":[{"url":"https://www.crunchbase.com/organization/atomic-wallet","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet","name":"","type":"other","archive_url":"http://web.archive.org/web/20251118215545/https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet","credibility":3,"archive_timestamp":"2025-11-18T21:55:45+00:00"},{"url":"https://www.dlnews.com/articles/defi/atomic-wallet-slammed-for-closed-code-amid-35m-dollar-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260617090749/https://www.dlnews.com/articles/defi/atomic-wallet-slammed-for-closed-code-amid-35m-dollar-hack/","credibility":3,"archive_timestamp":"2026-06-17T09:07:49+00:00"},{"url":"https://topclassactions.com/lawsuit-settlements/privacy/data-breach/atomic-wallet-knew-of-security-flaws-prior-to-breach-class-action-claims/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260726003857/https://topclassactions.com/lawsuit-settlements/privacy/data-breach/atomic-wallet-knew-of-security-flaws-prior-to-breach-class-action-claims/","credibility":3,"archive_timestamp":"2026-07-26T00:38:57+00:00"},{"url":"https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"","type":"other","archive_url":"http://web.archive.org/web/20260416044021/https://www.elliptic.co/blog/analysis/north-korea-linked-atomic-wallet-heist-tops-100-million","credibility":3,"archive_timestamp":"2026-04-16T04:40:21+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023","name":"","type":"other","archive_url":"http://web.archive.org/web/20260520141209/https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023","credibility":3,"archive_timestamp":"2026-05-20T14:12:09+00:00"},{"url":"https://decrypt.co/144444/north-korean-hackers-pocket-over-100-m-in-atomic-wallet-heist","name":"","type":"other","archive_url":"http://web.archive.org/web/20260311035221/https://decrypt.co/144444/north-korean-hackers-pocket-over-100-m-in-atomic-wallet-heist","credibility":3,"archive_timestamp":"2026-03-11T03:52:21+00:00"},{"url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260829142141/https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","credibility":3,"archive_timestamp":"2026-08-29T14:21:41+00:00"},{"url":"https://www.elliptic.co/blog/analysis/35-million-atomic-wallet-hacker-funnels-crypto-to-north-korea-s-favored-mixer","name":"","type":"other","archive_url":"http://web.archive.org/web/20260416054337/https://www.elliptic.co/blog/analysis/35-million-atomic-wallet-hacker-funnels-crypto-to-north-korea-s-favored-mixer","credibility":3,"archive_timestamp":"2026-04-16T05:43:37+00:00"},{"url":"https://www.coindesk.com/tech/2023/06/13/atomic-wallet-hackers-move-stolen-funds-via-ofac-sanctioned-exchange-garantex-elliptic","name":"","type":"other","archive_url":"http://web.archive.org/web/20260726005941/https://www.coindesk.com/tech/2023/06/13/atomic-wallet-hackers-move-stolen-funds-via-ofac-sanctioned-exchange-garantex-elliptic","credibility":3,"archive_timestamp":"2026-07-26T00:59:41+00:00"},{"url":"https://www.trmlabs.com/resources/blog/inside-north-koreas-crypto-heists","name":"","type":"other","archive_url":"http://web.archive.org/web/20260421020119/https://www.trmlabs.com/resources/blog/inside-north-koreas-crypto-heists","credibility":3,"archive_timestamp":"2026-04-21T02:01:19+00:00"},{"url":"https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2024/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260823164509/https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2024/","credibility":3,"archive_timestamp":"2026-08-23T16:45:09+00:00"},{"url":"https://www.classaction.org/news/class-action-filed-over-2023-atomic-wallet-data-breach-in-which-100m-in-crypto-assets-was-stolen","name":"","type":"other","archive_url":"http://web.archive.org/web/20260726043525/https://www.classaction.org/news/class-action-filed-over-2023-atomic-wallet-data-breach-in-which-100m-in-crypto-assets-was-stolen","credibility":3,"archive_timestamp":"2026-07-26T04:35:25+00:00"},{"url":"https://brownrudnick.com/client_news/brown-rudnick-wins-dismissal-of-class-action-suit-against-atomic-wallet-over-100m-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260727140839/https://brownrudnick.com/client_news/brown-rudnick-wins-dismissal-of-class-action-suit-against-atomic-wallet-over-100m-hack/","credibility":3,"archive_timestamp":"2026-07-27T14:08:39+00:00"},{"url":"https://cointelegraph.com/news/us-court-dismiss-atomic-wallet-class-suit-lack-jurisdiction","name":"","type":"other","archive_url":"http://web.archive.org/web/20260309003706/https://cointelegraph.com/news/us-court-dismiss-atomic-wallet-class-suit-lack-jurisdiction","credibility":3,"archive_timestamp":"2026-03-09T00:37:06+00:00"},{"url":"https://www.insideclassactions.com/2024/10/08/a-closer-look-court-applies-established-personal-jurisdiction-principles-to-dismiss-crypto-wallet-companies-in-class-action-filed-after-100-million-north-korean-crypto-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260515230409/https://www.insideclassactions.com/2024/10/08/a-closer-look-court-applies-established-personal-jurisdiction-principles-to-dismiss-crypto-wallet-companies-in-class-action-filed-after-100-million-north-korean-crypto-hack/","credibility":3,"archive_timestamp":"2026-05-15T23:04:09+00:00"},{"url":"https://hacken.io/discover/atomic-wallet-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260420190723/https://hacken.io/discover/atomic-wallet-hack/","credibility":3,"archive_timestamp":"2026-04-20T19:07:23+00:00"},{"url":"https://www.dlnews.com/articles/defi/atomic-wallet-faces-lawsuit-following-north-korean-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260617132140/https://www.dlnews.com/articles/defi/atomic-wallet-faces-lawsuit-following-north-korean-hack/","credibility":3,"archive_timestamp":"2026-06-17T13:21:40+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:41.775307+00:00","updated_at":"2026-08-29T19:06:52.626277+00:00"}}