{"investigation":{"slug":"coinex","entity_name":"CoinEx","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"CoinEx is a centralized cryptocurrency exchange that suffered a major hot wallet breach on September 12, 2023, with losses estimated between $54 million and $70 million across multiple blockchains. On-chain investigators ZachXBT and Elliptic attributed the attack to the Lazarus Group (TraderTraitor), a North Korean state-sponsored threat actor, based on wallet address overlap with the contemporaneous Stake.com hack. Stolen proceeds were subsequently laundered in part through the Sinbad Bitcoin mixer, which was sanctioned by the U.S. Treasury's OFAC on November 29, 2023.","sections":[{"content":"On September 12, 2023 at approximately 21:20 UTC+8, CoinEx's internal risk-control systems detected anomalous outflows from multiple hot wallets used for temporary storage of user assets. The root cause was identified as compromised private keys for those hot wallets. CoinEx officially confirmed the incident shortly after detection and suspended all deposit and withdrawal services globally across 211 blockchain networks and 737 assets. Estimates of total losses varied across sources: PeckShield placed early losses at approximately $43 million (comprising roughly $19 million in ETH, $11 million in TRON, $6.4 million in BNB Chain assets, $6 million in BTC, and $295,000 in MATIC), while CertiK Alert revised the figure to approximately $53–54 million after a second batch of affected addresses was identified on September 13. CoinEx itself later acknowledged a figure closer to $70 million in its post-incident communications. Assets stolen across both batches included ETH, TRX, BTC, BNB, XRP, SOL, MATIC, KDA, BCH, and XDAG. Cold wallets were reportedly not targeted, with remaining assets moved to cold storage within 48 hours of the breach.","heading":"The September 2023 Hot Wallet Breach","sources":[{"url":"https://coinex.medium.com/coinex-updates-on-recent-hot-wallets-hack-780a600dc846","name":"CoinEx Medium: Updates on Recent Hot Wallets Hack","type":"official","credibility":1},{"url":"https://www.bleepingcomputer.com/news/security/hackers-steal-53-million-worth-of-cryptocurrency-from-coinex/","name":"BleepingComputer: Hackers steal $53 million worth of cryptocurrency from CoinEx","type":"news_article","credibility":2},{"url":"https://thecryptobasic.com/2023/09/13/54m-in-xrp-bitcoin-ethereum-stolen-from-coinex-in-recent-hack/","name":"The Crypto Basic: $54M In XRP, Bitcoin, Ethereum Stolen from CoinEx","type":"news_article","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-coinex-hack-september-2023","name":"Halborn: Explained: The CoinEx Hack (September 2023)","type":"research","credibility":2},{"url":"https://immunebytes.com/blog/coinex-global-exploit-sep-12-2023-detailed-hack-analysis/","name":"ImmuneBytes: CoinEx Global Exploit – Sep 12, 2023 – Detailed Hack Analysis","type":"research","credibility":2}],"severity":"medium"},{"content":"On-chain investigator ZachXBT was among the first to publicly attribute the CoinEx breach to North Korea's Lazarus Group, specifically its TraderTraitor sub-operation. ZachXBT identified that stolen CoinEx funds had been routed to an Ethereum address (0x75497999432b8701330fb68058bd21918c02ac59) that had also received funds from the contemporaneous Stake.com hack ($41 million, attributed to Lazarus by the FBI in September 2023). Elliptic corroborated this finding, noting that 'some of the funds stolen from CoinEx were sent to an address which was used by the Lazarus group to launder funds stolen from Stake.com, albeit on a different blockchain,' and that funds were subsequently bridged to Ethereum using a bridge previously associated with Lazarus activity before being returned to a CoinEx-hacker-controlled address. Elliptic further noted overlap with funds from the $100 million Atomic Wallet theft of June 2023. Blockchain analytics firm SlowMist similarly confirmed the Lazarus Group connection. The FBI had previously attributed the Stake.com hack to North Korea's TraderTraitor group in September 2023, and the CoinEx breach fits the same operational pattern: targeting centralized exchange hot wallets, rapid multi-chain fund movement, and laundering through mixers. The FBI confirmed North Korean attribution for Atomic Wallet, Alphapo, CoinsPaid, and Stake.com — all attacks in the same 104-day window as CoinEx — making the circumstantial and forensic case for DPRK responsibility for CoinEx highly credible, though no formal FBI or DOJ charging document specifically names CoinEx at the time of this report.","heading":"North Korea TraderTraitor (Lazarus Group) Attribution","sources":[{"url":"https://www.coindesk.com/tech/2023/09/13/north-korean-attackers-linked-to-54m-coinex-hack-blockchain-data-suggests","name":"CoinDesk: North Korean Attackers Linked to $54M CoinEx Hack, Blockchain Data Suggests","type":"news_article","credibility":1},{"url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","name":"Elliptic: How the Lazarus Group is stepping up crypto hacks and changing its tactics","type":"research","credibility":2},{"url":"https://www.theblock.co/post/250691/north-korean-lazarus-group-likely-behind-coinexs-55-million-hack-zachxbt","name":"The Block: North Korean Lazarus Group likely behind CoinEx's $55 million hack — ZachXBT","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/coinex-north-korea-s-lazarus-group-responsible-for-55-m-coin-ex-hack-report","name":"CoinTelegraph: North Korea's Lazarus Group responsible for $55M CoinEx hack: Report","type":"news_article","credibility":2},{"url":"https://therecord.media/coinex-cryptocurrency-heist-north-korea","name":"The Record: Evidence points to North Korea in CoinEx cryptocurrency hack","type":"news_article","credibility":1},{"url":"https://cryptonews.com/news/elliptic-blockchain-surveillance-firm-north-korean-lazarus-group-theft-spree-reaches-240-million-104-days/","name":"CryptoNews: Elliptic — North Korean Lazarus Group Theft Spree Reaches $240 Million in 104 Days","type":"news_article","credibility":2}],"severity":"medium"},{"content":"A portion of the funds stolen from CoinEx were allegedly laundered through Sinbad.io, a Bitcoin mixing service used by North Korea's Lazarus Group across multiple heists. Laundering operations observed by researchers followed a multi-phase pattern: funds were first moved across chains, then passed through the Sinbad mixer via BTC, subsequently routed through Thorchain, and bridged back to Ethereum. On November 29, 2023, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated Sinbad.io as a sanctioned entity, citing its role as 'a key money-laundering tool for the Lazarus Group.' The same enforcement action resulted in the FBI and Dutch and Finnish law enforcement authorities seizing the Sinbad.io website. OFAC's press release documented Sinbad's use in laundering proceeds from the Stake.com, CoinEx, FTX, and Axie Infinity hacks, among others. Two specific Bitcoin addresses were added to OFAC's Specially Designated Nationals (SDN) list. The sanctioning of Sinbad represents a Tier 1 regulatory confirmation that the CoinEx hack proceeds were laundered through a DPRK-linked infrastructure.","heading":"Sinbad Mixer: Post-Hack Laundering","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy1933","name":"U.S. Treasury: Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency","type":"regulatory","credibility":1},{"url":"https://techcrunch.com/2023/11/29/feds-seize-sinbad-crypto-mixer-allegedly-used-by-north-korean-hackers/","name":"TechCrunch: Feds seize Sinbad crypto mixer allegedly used by North Korean hackers","type":"news_article","credibility":1},{"url":"https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","name":"Elliptic: Sinbad crypto mixer flagged by Elliptic sanctioned and seized","type":"research","credibility":2},{"url":"https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/","name":"Chainalysis: Crypto Mixer Sinbad Sanctioned for North Korean Laundering Activities","type":"research","credibility":2},{"url":"https://therecord.media/us-treasury-sanctions-sinbad-crypto-mixer","name":"The Record: US Treasury sanctions Sinbad cryptocurrency mixer used by North Korean hackers","type":"news_article","credibility":1},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"TRM Labs: What We Know About Sinbad — the Mixer Sanctioned by OFAC for its Use by North Korea","type":"research","credibility":2}],"severity":"medium"},{"content":"Following detection of the breach, CoinEx immediately halted all deposit and withdrawal services and shut down its hot wallet servers. Within 48 hours, the exchange moved remaining assets to cold storage, began building new wallet infrastructure, launched a formal security investigation, and coordinated with peer exchanges to freeze suspicious addresses. CoinEx publicly pledged 100% compensation to all affected users, with tailored per-coin compensation plans to be announced subsequently. The exchange stated the losses represented 'a small portion of total assets.' Service restoration was phased, beginning with select assets approximately one week after the breach, with deposits and withdrawals resuming for additional assets by September 21, 2023. CoinEx also announced plans to establish a dedicated Risk-Prevention Fund and to enhance security protocols through external security firm partnerships. According to post-incident reporting, CoinEx ultimately absorbed the full $70 million loss and restored normal operations within approximately nine months without diluting the supply of its native CET token.","heading":"Exchange Response, Compensation, and Service Restoration","sources":[{"url":"https://www.ccn.com/news/coinex-suspends-operations-full-compensation/","name":"CCN: CoinEx Suspends Operations After $54M Hack, Promises 100% Compensation","type":"news_article","credibility":2},{"url":"https://bitpinas.com/business/coinex-assures-compensation/","name":"BitPinas: CoinEx Assures 100% Compensation Following Recent Attack","type":"news_article","credibility":2},{"url":"https://beincrypto.com/coinex-resumes-deposits-withdrawals/","name":"BeInCrypto: CoinEx Resumes Deposits and Withdrawals After Hack","type":"news_article","credibility":2},{"url":"https://www.cryptonewsnavigator.com/academy/article/coinex-survived-a-70m-hack-and-rebuilt-in-9-months","name":"Crypto News Navigator: CoinEx Survived a $70M Hack and Rebuilt in 9 Months","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The CoinEx hack was one of at least five attacks attributed to North Korea's Lazarus Group in a 104-day period spanning June–September 2023, totaling approximately $240 million in stolen assets across: Atomic Wallet ($100 million, June 2023), Alphapo ($60 million, July 2023), CoinsPaid ($37.3 million, July 2023), Stake.com ($41 million, September 2023), and CoinEx ($54–70 million, September 2023). The FBI officially attributed the Stake.com and Atomic Wallet hacks to TraderTraitor, the Lazarus Group sub-operation focused on cryptocurrency and blockchain targets. The Lazarus Group is a state-sponsored threat actor controlled by the DPRK's Reconnaissance General Bureau. U.S. officials have stated that North Korea's cryptocurrency theft operations are used to fund ballistic missile and weapons of mass destruction programs. Chainalysis data indicated North Korean cryptocurrency thefts totaled over $340 million in all of 2023, with the summer–fall 2023 spree representing the majority of that figure. The operational fingerprint across the five attacks — compromised hot wallet private keys, rapid multi-chain fund movement, use of cross-chain bridges previously linked to Lazarus, and laundering through Sinbad — is consistent with documented TraderTraitor tactics, techniques, and procedures (TTPs).","heading":"Broader Lazarus Group Threat Context","sources":[{"url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","name":"Elliptic: How the Lazarus Group is stepping up crypto hacks and changing its tactics","type":"research","credibility":2},{"url":"https://risky.biz/north-korean-hackers-are-behind-coinex-hack/","name":"Risky Business News: Lazarus steals $54 million from CoinEx crypto-exchange","type":"news_article","credibility":2},{"url":"https://coinmarketcap.com/academy/article/dollar54m-coinex-hack-linked-to-north-korean-lazarus-group","name":"CoinMarketCap: $54M CoinEx Hack Linked to North Korean Lazarus Group","type":"news_article","credibility":2},{"url":"https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/","name":"Chainalysis: Crypto Mixer Sinbad Sanctioned for North Korean Laundering Activities","type":"research","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2023-09-12","event":"CoinEx hot wallets breached at approximately 21:20 UTC+8; private keys compromised; anomalous outflows detected across Ethereum, TRON, BNB Chain, Bitcoin, and other networks. Deposits and withdrawals suspended globally.","source":"","source_url":"https://coinex.medium.com/coinex-updates-on-recent-hot-wallets-hack-780a600dc846"},{"date":"2023-09-13","event":"ZachXBT publicly identifies wallet address overlap between CoinEx hacker and Stake.com hacker (attributed to Lazarus Group), suggesting North Korean origin. Elliptic corroborates, noting funds routed through Lazarus-linked bridge infrastructure. Estimated losses revised upward to $54 million after second batch of affected addresses identified.","source":"","source_url":"https://www.theblock.co/post/250691/north-korean-lazarus-group-likely-behind-coinexs-55-million-hack-zachxbt"},{"date":"2023-09-13","event":"CoinEx pledges 100% compensation to all affected users; states cold wallets were not targeted and remaining assets have been secured.","source":"","source_url":"https://www.ccn.com/news/coinex-suspends-operations-full-compensation/"},{"date":"2023-09-15","event":"The Record and other outlets publish detailed attribution reports linking CoinEx breach to North Korea's Lazarus Group based on Elliptic and ZachXBT blockchain forensics.","source":"","source_url":"https://therecord.media/coinex-cryptocurrency-heist-north-korea"},{"date":"2023-09-21","event":"CoinEx begins phased resumption of deposit and withdrawal services for select assets after security infrastructure overhaul.","source":"","source_url":"https://beincrypto.com/coinex-resumes-deposits-withdrawals/"},{"date":"2023-11-29","event":"U.S. Treasury OFAC sanctions Sinbad.io Bitcoin mixer, explicitly citing its use in laundering funds stolen from CoinEx and other Lazarus Group hacks. FBI and Dutch and Finnish law enforcement seize the Sinbad.io domain.","source":"","source_url":"https://home.treasury.gov/news/press-releases/jy1933"}],"sources_used":[{"url":"https://coinex.medium.com/coinex-updates-on-recent-hot-wallets-hack-780a600dc846","name":"CoinEx Medium: Updates on Recent Hot Wallets Hack","type":"official","archive_url":"http://web.archive.org/web/20251114083237/https://coinex.medium.com/coinex-updates-on-recent-hot-wallets-hack-780a600dc846","credibility":1,"archive_timestamp":"2025-11-14T08:32:37+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-steal-53-million-worth-of-cryptocurrency-from-coinex/","name":"BleepingComputer: Hackers steal $53 million worth of cryptocurrency from CoinEx","type":"news_article","archive_url":"http://web.archive.org/web/20251201002200/https://www.bleepingcomputer.com/news/security/hackers-steal-53-million-worth-of-cryptocurrency-from-coinex/","credibility":2,"archive_timestamp":"2025-12-01T00:22:00+00:00"},{"url":"https://thecryptobasic.com/2023/09/13/54m-in-xrp-bitcoin-ethereum-stolen-from-coinex-in-recent-hack/","name":"The Crypto Basic: $54M In XRP, Bitcoin, Ethereum Stolen from CoinEx","type":"news_article","archive_url":"https://web.archive.org/web/20260829081912/https://thecryptobasic.com/2023/09/13/54m-in-xrp-bitcoin-ethereum-stolen-from-coinex-in-recent-hack/","credibility":2,"archive_timestamp":"2026-08-29T08:19:12+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-coinex-hack-september-2023","name":"Halborn: Explained: The CoinEx Hack (September 2023)","type":"research","archive_url":"http://web.archive.org/web/20260415063049/https://www.halborn.com/blog/post/explained-the-coinex-hack-september-2023","credibility":2,"archive_timestamp":"2026-04-15T06:30:49+00:00"},{"url":"https://immunebytes.com/blog/coinex-global-exploit-sep-12-2023-detailed-hack-analysis/","name":"ImmuneBytes: CoinEx Global Exploit – Sep 12, 2023 – Detailed Hack Analysis","type":"research","archive_url":"http://web.archive.org/web/20260309084148/https://immunebytes.com/blog/coinex-global-exploit-sep-12-2023-detailed-hack-analysis/","credibility":2,"archive_timestamp":"2026-03-09T08:41:48+00:00"},{"url":"https://www.coindesk.com/tech/2023/09/13/north-korean-attackers-linked-to-54m-coinex-hack-blockchain-data-suggests","name":"CoinDesk: North Korean Attackers Linked to $54M CoinEx Hack, Blockchain Data Suggests","type":"news_article","archive_url":"http://web.archive.org/web/20260709220128/https://www.coindesk.com/tech/2023/09/13/north-korean-attackers-linked-to-54m-coinex-hack-blockchain-data-suggests","credibility":1,"archive_timestamp":"2026-07-09T22:01:28+00:00"},{"url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","name":"Elliptic: How the Lazarus Group is stepping up crypto hacks and changing its tactics","type":"research","archive_url":"http://web.archive.org/web/20260511085148/https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","credibility":2,"archive_timestamp":"2026-05-11T08:51:48+00:00"},{"url":"https://www.theblock.co/post/250691/north-korean-lazarus-group-likely-behind-coinexs-55-million-hack-zachxbt","name":"The Block: North Korean Lazarus Group likely behind CoinEx's $55 million hack — ZachXBT","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/coinex-north-korea-s-lazarus-group-responsible-for-55-m-coin-ex-hack-report","name":"CoinTelegraph: North Korea's Lazarus Group responsible for $55M CoinEx hack: Report","type":"news_article","archive_url":"https://web.archive.org/web/20260829113505/https://cointelegraph.com/news/coinex-north-korea-s-lazarus-group-responsible-for-55-m-coin-ex-hack-report","credibility":2,"archive_timestamp":"2026-08-29T11:35:05+00:00"},{"url":"https://therecord.media/coinex-cryptocurrency-heist-north-korea","name":"The Record: Evidence points to North Korea in CoinEx cryptocurrency hack","type":"news_article","archive_url":"http://web.archive.org/web/20260607014440/https://therecord.media/coinex-cryptocurrency-heist-north-korea","credibility":1,"archive_timestamp":"2026-06-07T01:44:40+00:00"},{"url":"https://cryptonews.com/news/elliptic-blockchain-surveillance-firm-north-korean-lazarus-group-theft-spree-reaches-240-million-104-days/","name":"CryptoNews: Elliptic — North Korean Lazarus Group Theft Spree Reaches $240 Million in 104 Days","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://home.treasury.gov/news/press-releases/jy1933","name":"U.S. Treasury: Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency","type":"regulatory","archive_url":"http://web.archive.org/web/20260529070738/https://home.treasury.gov/news/press-releases/jy1933","credibility":1,"archive_timestamp":"2026-05-29T07:07:38+00:00"},{"url":"https://techcrunch.com/2023/11/29/feds-seize-sinbad-crypto-mixer-allegedly-used-by-north-korean-hackers/","name":"TechCrunch: Feds seize Sinbad crypto mixer allegedly used by North Korean hackers","type":"news_article","archive_url":"http://web.archive.org/web/20260519204638/https://techcrunch.com/2023/11/29/feds-seize-sinbad-crypto-mixer-allegedly-used-by-north-korean-hackers/","credibility":1,"archive_timestamp":"2026-05-19T20:46:38+00:00"},{"url":"https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","name":"Elliptic: Sinbad crypto mixer flagged by Elliptic sanctioned and seized","type":"research","archive_url":"http://web.archive.org/web/20260412061206/https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","credibility":2,"archive_timestamp":"2026-04-12T06:12:06+00:00"},{"url":"https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/","name":"Chainalysis: Crypto Mixer Sinbad Sanctioned for North Korean Laundering Activities","type":"research","archive_url":"http://web.archive.org/web/20260514050238/https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/","credibility":2,"archive_timestamp":"2026-05-14T05:02:38+00:00"},{"url":"https://therecord.media/us-treasury-sanctions-sinbad-crypto-mixer","name":"The Record: US Treasury sanctions Sinbad cryptocurrency mixer used by North Korean hackers","type":"news_article","archive_url":"http://web.archive.org/web/20260512060123/https://therecord.media/us-treasury-sanctions-sinbad-crypto-mixer","credibility":1,"archive_timestamp":"2026-05-12T06:01:23+00:00"},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"TRM Labs: What We Know About Sinbad — the Mixer Sanctioned by OFAC for its Use by North Korea","type":"research","archive_url":"http://web.archive.org/web/20260512211804/https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","credibility":2,"archive_timestamp":"2026-05-12T21:18:04+00:00"},{"url":"https://www.ccn.com/news/coinex-suspends-operations-full-compensation/","name":"CCN: CoinEx Suspends Operations After $54M Hack, Promises 100% Compensation","type":"news_article","archive_url":"http://web.archive.org/web/20250903170625/https://www.ccn.com/news/coinex-suspends-operations-full-compensation/","credibility":2,"archive_timestamp":"2025-09-03T17:06:25+00:00"},{"url":"https://bitpinas.com/business/coinex-assures-compensation/","name":"BitPinas: CoinEx Assures 100% Compensation Following Recent Attack","type":"news_article","archive_url":"http://web.archive.org/web/20260414133832/https://bitpinas.com/business/coinex-assures-compensation/","credibility":2,"archive_timestamp":"2026-04-14T13:38:32+00:00"},{"url":"https://beincrypto.com/coinex-resumes-deposits-withdrawals/","name":"BeInCrypto: CoinEx Resumes Deposits and Withdrawals After Hack","type":"news_article","archive_url":"http://web.archive.org/web/20250831094150/https://beincrypto.com/coinex-resumes-deposits-withdrawals//","credibility":2,"archive_timestamp":"2025-08-31T09:41:50+00:00"},{"url":"https://www.cryptonewsnavigator.com/academy/article/coinex-survived-a-70m-hack-and-rebuilt-in-9-months","name":"Crypto News Navigator: CoinEx Survived a $70M Hack and Rebuilt in 9 Months","type":"news_article","archive_url":"https://web.archive.org/web/20260829085243/https://www.cryptonewsnavigator.com/academy/article/coinex-survived-a-70m-hack-and-rebuilt-in-9-months","credibility":2,"archive_timestamp":"2026-08-29T08:52:43+00:00"},{"url":"https://risky.biz/north-korean-hackers-are-behind-coinex-hack/","name":"Risky Business News: Lazarus steals $54 million from CoinEx crypto-exchange","type":"news_article","archive_url":"https://web.archive.org/web/20260829180543/https://risky.biz/north-korean-hackers-are-behind-coinex-hack/","credibility":2,"archive_timestamp":"2026-08-29T18:05:43+00:00"},{"url":"https://coinmarketcap.com/academy/article/dollar54m-coinex-hack-linked-to-north-korean-lazarus-group","name":"CoinMarketCap: $54M CoinEx Hack Linked to North Korean Lazarus Group","type":"news_article","archive_url":"https://web.archive.org/web/20260829112958/https://coinmarketcap.com/academy/article/dollar54m-coinex-hack-linked-to-north-korean-lazarus-group","credibility":2,"archive_timestamp":"2026-08-29T11:29:58+00:00"}],"source_tags":["defillama","slowmist","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:10.583427+00:00","updated_at":"2026-08-30T20:07:18.760993+00:00"}}