{"investigation":{"slug":"atomic-wallet","entity_name":"Atomic Wallet","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Atomic Wallet is a non-custodial cryptocurrency wallet, operated by Estonia-registered Atomic Protocol Systems OÜ and founded by Konstantin Gladych, that lost more than $100 million of user funds in a June 2023 breach blockchain analytics firm Elliptic has attributed to North Korea's Lazarus Group. A security firm had publicly warned of unresolved vulnerabilities in the wallet roughly sixteen months before the hack, and a resulting U.S. class action was dismissed in 2024 on jurisdictional grounds rather than on the merits. Malaysia's securities regulator later flagged the service for operating without registration.","sections":[{"content":"Starting around June 2, 2023, attackers drained funds from thousands of Atomic Wallet users' wallets. On-chain investigator ZachXBT initially estimated losses at over $35 million, but blockchain analytics firm Elliptic subsequently raised the estimate to more than $100 million, tracking over 5,000 compromised wallets, with at least ten addresses losing more than $1 million each and at least 164 losing more than $100,000. Elliptic attributed the theft to North Korea's Lazarus Group and reported that the stolen funds were later laundered in part through the Russia-based exchange Garantex, which the U.S. Treasury had sanctioned in 2022. Atomic Wallet, a non-custodial (self-custody) wallet, has not confirmed the Lazarus Group attribution and has not published a technical explanation of the hack's root cause. The company said publicly that \"less than 0.1%\" of its roughly 5 million users were affected, a claim that commentators have noted is difficult to reconcile with the scale of losses reported by independent analysts.","heading":"June 2023 Hack (~$100 Million)","sources":[{"url":"https://www.elliptic.co/insights/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"Elliptic: North Korea-linked Atomic Wallet heist tops $100 million","type":"research","credibility":2},{"url":"https://decrypt.co/144444/north-korean-hackers-pocket-over-100-m-in-atomic-wallet-heist","name":"Decrypt: North Korean Hackers Pocket Over $100M in Atomic Wallet Heist","type":"news_article","credibility":2},{"url":"https://decrypt.co/145765","name":"Decrypt: Atomic Wallet Claims 'Less Than 0.1%' of Users Affected by $100M Hack","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2023/08/north-korean-affiliates-suspected-in.html","name":"The Hacker News: North Korean Affiliates Suspected in Multiple Crypto Heists","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Security auditor Least Authority was engaged to review Atomic Wallet's system design and its core, desktop and mobile implementations starting in early 2021, delivering an audit around April 2021. In February 2022, after what it described as roughly ten months of following responsible-disclosure procedures without the issues being fixed, Least Authority published a blog post warning Atomic Wallet users that \"a significant number of issues and suggestions remain unresolved,\" citing concerns including Atomic's use of the Electron framework and out-of-date dependencies, and stating that the \"design and implementation of the Atomic Wallet system does not sufficiently demonstrate considerations for security.\" The post withheld technical detail to avoid putting users at greater risk. According to CoinDesk, this was the first time since Least Authority's founding in 2011 that it had publicly flagged unresolved issues in a client's product. Atomic Wallet's CEO, Konstantin Gladych, told CoinDesk the company would implement the firm's recommendations by the second quarter of 2022. The subsequent class-action complaint over the June 2023 hack alleges that the defendants \"knew of existing security vulnerabilities in the Atomic Wallet platform since at least as early as 2022 but failed to take necessary security measures or precautions to protect user data and funds\" — an allegation, not a judicial finding.","heading":"Prior Security Warnings (Least Authority, 2021-2022)","sources":[{"url":"https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet/","name":"CoinDesk: Least Authority Discloses Security Risks in Atomic Wallet","type":"news_article","credibility":2},{"url":"https://storage.courtlistener.com/recap/gov.uscourts.cod.225515/gov.uscourts.cod.225515.1.0.pdf","name":"Robert Meany et al. v. Atomic Wallet et al., Class Action Complaint, No. 1:23-cv-1582 (D. Colo.)","type":"court_filing","credibility":1}],"severity":"high"},{"content":"On June 21, 2023, Robert Meany and Graham Dickinson filed a putative class action, Meany v. Atomic Wallet and Konstantin Gladych, Case No. 1:23-cv-01582, in the U.S. District Court for the District of Colorado, seeking to represent Atomic Wallet users and alleging roughly $100 million in losses from the June 2023 hack. An amended complaint filed around August 2023 added more named plaintiffs and named Evercode Infinite, the Estonian software firm behind the wallet, and its co-founder Ilia Brusov as additional defendants. On September 10, 2024, Colorado district court judge Philip Brimmer dismissed the claims against Atomic Wallet, its CEO, a shareholder, and Evercode Infinite for lack of personal jurisdiction, finding the defendants' contacts with Colorado too thin to support suit there and noting only one of the 21 named plaintiffs resided in Colorado; the dismissal of those defendants was without leave to amend. Brimmer separately gave the plaintiffs an additional 21 days to show why claims against Brusov specifically should not also be dismissed. The dismissal resolved the case on jurisdictional grounds and did not reach the merits of the underlying security allegations.","heading":"Class Action: Meany v. Atomic Wallet (Dismissed 2024)","sources":[{"url":"https://cointelegraph.com/news/us-court-dismiss-atomic-wallet-class-suit-lack-jurisdiction","name":"Cointelegraph: US court dismisses Atomic Wallet class suit over lack of US ties","type":"news_article","credibility":2},{"url":"https://www.insideclassactions.com/2024/10/08/a-closer-look-court-applies-established-personal-jurisdiction-principles-to-dismiss-crypto-wallet-companies-in-class-action-filed-after-100-million-north-korean-crypto-hack/","name":"Inside Class Actions: Court dismisses crypto wallet companies in class action filed after $100 million North Korean crypto hack","type":"news_article","credibility":2},{"url":"https://storage.courtlistener.com/recap/gov.uscourts.cod.225515/gov.uscourts.cod.225515.1.0.pdf","name":"Robert Meany et al. v. Atomic Wallet et al., Class Action Complaint, No. 1:23-cv-1582 (D. Colo.)","type":"court_filing","credibility":1},{"url":"https://news.bloomberglaw.com/litigation/atomic-wallet-users-sue-over-100-million-in-crypto-lost-to-hack","name":"Bloomberg Law: Atomic Wallet Users Sue Over $100 Million in Crypto Lost to Hack","type":"news_article","credibility":1}],"severity":"medium"},{"content":"On August 23, 2023, TechCrunch and other outlets reported that the FBI had issued a public advisory, titled \"FBI Identifies Cryptocurrency Funds Stolen by DPRK,\" warning cryptocurrency firms of blockchain activity tied to the theft of hundreds of millions of dollars and stating that North Korea-linked actors operating under the names TraderTraitor, Lazarus Group, and APT38 had moved roughly 1,580 bitcoin (then worth more than $40 million) that it tied to several 2023 thefts, providing six bitcoin addresses for the industry to monitor. Coverage of the advisory listed the Atomic Wallet theft, along with breaches at Alphapo and CoinsPaid, among the incidents linked to this North Korean cash-out activity. This advisory corroborates North Korean involvement in the broader 2023 heist cluster but is not, on its own, a formal U.S. government attribution specific to the Atomic Wallet breach.","heading":"FBI Advisory on Linked North Korean Cash-Out Activity","sources":[{"url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","name":"TechCrunch: FBI says North Korean hackers preparing to cash out after high-profile crypto hacks","type":"news_article","credibility":1},{"url":"https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk","name":"FBI: FBI Identifies Cryptocurrency Funds Stolen by DPRK","type":"regulatory","credibility":1},{"url":"https://securityaffairs.com/149798/hacking/north-korea-cash-out-stolen-crypto-assets.html","name":"Security Affairs: FBI identifies wallets holding cryptocurrency funds stolen by North Korea","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Industry trackers included the Atomic Wallet breach among the largest crypto hacks and exploits of 2023. The Block's year-end roundup listed the roughly $100 million Atomic Wallet theft alongside incidents such as the Euler Finance (~$197 million) and Multichain (~$125 million) exploits. A search for a Chainalysis annual crypto crime report explicitly ranking the Atomic Wallet hack among 2023's largest incidents did not turn up that specific document; Chainalysis's year-end figures found in this research instead covered total annual theft volumes for 2023 and 2024 without a confirmed, directly-sourced ranking naming Atomic Wallet. This specific claim from the prior version of this page could not be verified and has been replaced with the corroborated industry ranking below.","heading":"Largest 2023 Hacks Ranking","sources":[{"url":"https://www.theblock.co/post/268831/the-10-largest-crypto-hacks-and-exploits-of-2023","name":"The Block: The 10 largest crypto hacks and exploits of 2023","type":"news_article","credibility":2},{"url":"https://decrypt.co/210802/biggest-crypto-hacks-of-2023","name":"Decrypt: Biggest Crypto Hacks of 2023","type":"news_article","credibility":2}],"severity":"low"},{"content":"Malaysia's Securities Commission flagged Atomic Wallet on its list of entities believed to be operating a digital asset exchange without the required registration in the country, according to Cointelegraph's reporting on the commission's published list. The commission's notice did not provide further detail on the basis for including Atomic Wallet, and no penalty or enforcement order beyond the listing was identified in available reporting.","heading":"Malaysia Regulatory Warning (2024)","sources":[{"url":"https://cointelegraph.com/news/malaysia-flags-atomic-wallet-unauthorized-operation","name":"Cointelegraph: Malaysia flags Atomic Wallet for unauthorized operation","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Atomic Wallet is operated by Atomic Protocol Systems OÜ, doing business as Atomic Wallet, an entity registered in Estonia, with Konstantin Gladych — also a co-founder of the Changelly exchange — identified as CEO in court filings and press coverage. The wallet is non-custodial, meaning private keys and transaction data are stored on users' own devices rather than held by the company, which Atomic Wallet has cited as a reason the 2023 breach did not stem from a central server compromise. As of 2026, third-party reviews and wallet directories describe Atomic Wallet as still operating and supporting staking and a large number of assets; these sources are low-credibility (promotional blog posts and crowd-maintained directories) and no independent news coverage of the wallet's current operational status was found, so this should be treated as low-confidence information.","heading":"Company Background and Current Status","sources":[{"url":"https://www.offshorealert.com/robert-meany-et-al-v-atomic-wallet-et-al-class-action-complaint-100m-crypto-theft/","name":"OffshoreAlert: Robert Meany et al v. Atomic Wallet et al Class Action Complaint","type":"court_filing","credibility":2}],"severity":"low"}],"timeline":[{"date":"2021","event":"Least Authority engaged to audit Atomic Wallet's system design and core, desktop and mobile implementations.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet/"},{"date":"2022-02","event":"Least Authority publicly discloses unresolved security vulnerabilities in Atomic Wallet after roughly ten months of private responsible-disclosure attempts.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet/"},{"date":"2023-06-02","event":"Attackers begin draining funds from Atomic Wallet users, ultimately totaling over $100 million.","source":"The Hacker News","source_url":"https://thehackernews.com/2023/08/north-korean-affiliates-suspected-in.html","date_evidence":"the $100 million theft of virtual currency from Atomic Wallet on June 2, 2023"},{"date":"2023-06","event":"Robert Meany and Graham Dickinson file class action complaint against Atomic Wallet and Konstantin Gladych in the U.S. District Court for the District of Colorado, Case No. 1:23-cv-01582.","source":"Class action complaint (CourtListener)","source_url":"https://storage.courtlistener.com/recap/gov.uscourts.cod.225515/gov.uscourts.cod.225515.1.0.pdf","date_evidence":"/CreationDate (D:20230621170732-05'00')","date_original":"2023-06-21"},{"date":"2023-08","event":"An amended class action complaint adds Evercode Infinite and Ilia Brusov as defendants.","source":"Bloomberg Law","source_url":"https://news.bloomberglaw.com/litigation/evercode-seeks-dismissal-from-100-million-atomic-wallet-suit"},{"date":"2023-08-23","event":"FBI advisory linking North Korea-affiliated actors to cash-out activity tied to the Atomic Wallet, Alphapo, and CoinsPaid thefts is reported.","source":"TechCrunch","source_url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","date_evidence":"5:05 AM PDT · August 23, 2023"},{"date":"2024-09","event":"Judge Philip Brimmer dismisses the Colorado class action against Atomic Wallet, its CEO, a shareholder, and Evercode Infinite for lack of personal jurisdiction, without leave to amend; plaintiffs given 21 additional days on claims against Ilia Brusov.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/us-court-dismiss-atomic-wallet-class-suit-lack-jurisdiction","date_evidence":"In a Sept. 10 order, Colorado district court judge Philip Brimmer dismissed claims against Atomic Wallet","date_original":"2024-09-10"},{"date":"2024-12","event":"Malaysia's Securities Commission lists Atomic Wallet among entities allegedly operating a digital asset exchange without registration.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/malaysia-flags-atomic-wallet-unauthorized-operation"}],"sources_used":[{"url":"https://www.elliptic.co/insights/north-korea-linked-atomic-wallet-heist-tops-100-million","name":"Elliptic: North Korea-linked Atomic Wallet heist tops $100 million","type":"research","archive_url":"http://web.archive.org/web/20261005205014/https://www.elliptic.co/insights/north-korea-linked-atomic-wallet-heist-tops-100-million/","credibility":2,"archive_timestamp":"2026-10-05T20:50:14+00:00"},{"url":"https://decrypt.co/144444/north-korean-hackers-pocket-over-100-m-in-atomic-wallet-heist","name":"Decrypt: North Korean Hackers Pocket Over $100M in Atomic Wallet Heist","type":"news_article","archive_url":"http://web.archive.org/web/20261005204626/https://decrypt.co/144444/north-korean-hackers-pocket-over-100-m-in-atomic-wallet-heist","credibility":2,"archive_timestamp":"2026-10-05T20:46:26+00:00"},{"url":"https://decrypt.co/145765","name":"Decrypt: Atomic Wallet Claims 'Less Than 0.1%' of Users Affected by $100M Hack","type":"news_article","archive_url":"http://web.archive.org/web/20261106050510/https://decrypt.co/145765","credibility":2,"archive_timestamp":"2026-11-06T05:05:10+00:00"},{"url":"https://thehackernews.com/2023/08/north-korean-affiliates-suspected-in.html","name":"The Hacker News: North Korean Affiliates Suspected in Multiple Crypto Heists","type":"news_article","archive_url":"http://web.archive.org/web/20260515141530/https://thehackernews.com/2023/08/north-korean-affiliates-suspected-in.html","credibility":2,"archive_timestamp":"2026-05-15T14:15:30+00:00"},{"url":"https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet/","name":"CoinDesk: Least Authority Discloses Security Risks in Atomic Wallet","type":"news_article","archive_url":"http://web.archive.org/web/20261005204241/https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet","credibility":2,"archive_timestamp":"2026-10-05T20:42:41+00:00"},{"url":"https://storage.courtlistener.com/recap/gov.uscourts.cod.225515/gov.uscourts.cod.225515.1.0.pdf","name":"Robert Meany et al. v. Atomic Wallet et al., Class Action Complaint, No. 1:23-cv-1582 (D. Colo.)","type":"court_filing","archive_url":"http://web.archive.org/web/20261106051444/https://storage.courtlistener.com/recap/gov.uscourts.cod.225515/gov.uscourts.cod.225515.1.0.pdf","credibility":1,"archive_timestamp":"2026-11-06T05:14:44+00:00"},{"url":"https://cointelegraph.com/news/us-court-dismiss-atomic-wallet-class-suit-lack-jurisdiction","name":"Cointelegraph: US court dismisses Atomic Wallet class suit over lack of US ties","type":"news_article","archive_url":"http://web.archive.org/web/20261005204724/https://cointelegraph.com/news/us-court-dismiss-atomic-wallet-class-suit-lack-jurisdiction","credibility":2,"archive_timestamp":"2026-10-05T20:47:24+00:00"},{"url":"https://www.insideclassactions.com/2024/10/08/a-closer-look-court-applies-established-personal-jurisdiction-principles-to-dismiss-crypto-wallet-companies-in-class-action-filed-after-100-million-north-korean-crypto-hack/","name":"Inside Class Actions: Court dismisses crypto wallet companies in class action filed after $100 million North Korean crypto hack","type":"news_article","archive_url":"http://web.archive.org/web/20261005204352/https://www.insideclassactions.com/2024/10/08/a-closer-look-court-applies-established-personal-jurisdiction-principles-to-dismiss-crypto-wallet-companies-in-class-action-filed-after-100-million-north-korean-crypto-hack/","credibility":2,"archive_timestamp":"2026-10-05T20:43:52+00:00"},{"url":"https://news.bloomberglaw.com/litigation/atomic-wallet-users-sue-over-100-million-in-crypto-lost-to-hack","name":"Bloomberg Law: Atomic Wallet Users Sue Over $100 Million in Crypto Lost to Hack","type":"news_article","archive_url":"http://web.archive.org/web/20261106051815/https://news.bloomberglaw.com/litigation/atomic-wallet-users-sue-over-100-million-in-crypto-lost-to-hack","credibility":1,"archive_timestamp":"2026-11-06T05:18:15+00:00"},{"url":"https://news.bloomberglaw.com/litigation/evercode-seeks-dismissal-from-100-million-atomic-wallet-suit","name":"Bloomberg Law: Evercode Seeks Dismissal From $100 Million Atomic Wallet Suit","type":"news_article","archive_url":"http://web.archive.org/web/20261106051924/https://news.bloomberglaw.com/litigation/evercode-seeks-dismissal-from-100-million-atomic-wallet-suit","credibility":1,"archive_timestamp":"2026-11-06T05:19:24+00:00"},{"url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","name":"TechCrunch: FBI says North Korean hackers preparing to cash out after high-profile crypto hacks","type":"news_article","archive_url":"http://web.archive.org/web/20261005205041/https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/","credibility":1,"archive_timestamp":"2026-10-05T20:50:41+00:00"},{"url":"https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk","name":"FBI: FBI Identifies Cryptocurrency Funds Stolen by DPRK","type":"regulatory","archive_url":"http://web.archive.org/web/20261004100523/https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk","credibility":1,"archive_timestamp":"2026-10-04T10:05:23+00:00"},{"url":"https://securityaffairs.com/149798/hacking/north-korea-cash-out-stolen-crypto-assets.html","name":"Security Affairs: FBI identifies wallets holding cryptocurrency funds stolen by North Korea","type":"news_article","archive_url":"http://web.archive.org/web/20260613155423/https://securityaffairs.com/149798/hacking/north-korea-cash-out-stolen-crypto-assets.html","credibility":2,"archive_timestamp":"2026-06-13T15:54:23+00:00"},{"url":"https://www.theblock.co/post/268831/the-10-largest-crypto-hacks-and-exploits-of-2023","name":"The Block: The 10 largest crypto hacks and exploits of 2023","type":"news_article","archive_url":"http://web.archive.org/web/20260211141328/https://www.theblock.co/post/268831/the-10-largest-crypto-hacks-and-exploits-of-2023","credibility":2,"archive_timestamp":"2026-02-11T14:13:28+00:00"},{"url":"https://decrypt.co/210802/biggest-crypto-hacks-of-2023","name":"Decrypt: Biggest Crypto Hacks of 2023","type":"news_article","archive_url":"http://web.archive.org/web/20260714215239/https://decrypt.co/210802/biggest-crypto-hacks-of-2023","credibility":2,"archive_timestamp":"2026-07-14T21:52:39+00:00"},{"url":"https://cointelegraph.com/news/malaysia-flags-atomic-wallet-unauthorized-operation","name":"Cointelegraph: Malaysia flags Atomic Wallet for unauthorized operation","type":"news_article","archive_url":"http://web.archive.org/web/20260417034204/https://cointelegraph.com/news/malaysia-flags-atomic-wallet-unauthorized-operation","credibility":2,"archive_timestamp":"2026-04-17T03:42:04+00:00"},{"url":"https://www.offshorealert.com/robert-meany-et-al-v-atomic-wallet-et-al-class-action-complaint-100m-crypto-theft/","name":"OffshoreAlert: Robert Meany et al v. Atomic Wallet et al Class Action Complaint","type":"court_filing","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-04T02:54:41.775307+00:00","updated_at":"2026-11-06T06:24:19.276919+00:00"},"source_quality":{"total":17,"tier1":2,"tier2":8,"tier3":0,"unrated":7},"follower_count":null,"content_updated_at":"2026-11-02T03:18:59.885Z","last_fact_checked_at":"2026-11-02T03:18:59.492Z","fact_check_next_allowed_at":"2026-11-09T03:18:59.492Z","update_next_allowed_at":"2026-11-09T00:35:17.190Z"}