{"investigation":{"slug":"dexx","entity_name":"DEXX","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"DEXX is a Solana-based on-chain memecoin trading terminal that suffered a catastrophic private key compromise on November 16, 2024, resulting in approximately $30 million in user losses across more than 8,600 wallets. Despite marketing itself as non-custodial, DEXX stored user private keys in plaintext on its own servers — a centralization risk that CertiK had flagged as unresolved prior to the breach. A partial compensation initiative led by LBank was announced in early 2025, but full recovery of stolen funds remains unlikely as the attacker laundered substantial ETH through Tornado Cash.","sections":[{"content":"DEXX describes itself as the first on-chain memecoin trading terminal application on Solana, offering integrated data analysis, advanced trading strategies, and smart wallet monitoring. The platform marketed a 'one-click trade' feature designed for retail memecoin traders seeking fast execution without managing wallets manually. To support this convenience feature, DEXX operated what critics later characterized as a de facto custodial model: user private keys were stored on DEXX's centralized servers, contradicting the platform's public non-custodial branding. A pre-incident security audit by CertiK assigned DEXX a score of 59.31 — a failing grade — flagging nine identified risks, with the primary 'centralization' risk listed as unresolved. Additional unresolved moderate risks included 'vulnerable code.' The audit results were publicly available via CertiK Skynet prior to the November 2024 incident but did not prompt corrective action from the team. The platform's founder is identified only as 'Roy' in public communications; no further verified biographical detail about the team has been reported by credible outlets.","heading":"Background","sources":[{"url":"https://skynet.certik.com/projects/dexx","name":"","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2152340","name":"","type":"other","credibility":3},{"url":"https://www.coinglass.com/learn/dexx-scandal-en","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 16, 2024, user assets began draining from DEXX wallets in the early morning hours. Multiple memecoin positions experienced simultaneous liquidations, which alerted the community before any official disclosure. CertiK confirmed at 1:27 PM (local time) that the breach occurred on the Solana blockchain and attributed it to 'improper private key management by the DEXX platform.' Blockchain security researcher Cosmos Yu noted that each victim was assigned a distinct attacker address, indicating coordinated and pre-planned execution rather than an opportunistic single-address theft. The core vulnerability was DEXX's centralized private key storage: when users exported private keys through the platform interface, keys were transmitted and displayed in plaintext, meaning they resided on DEXX's servers at all times. Security researchers at OneKey additionally noted that DEXX repeatedly requested clipboard access in its application, potentially enabling interception of key material through that vector. DEXX founder Roy acknowledged the breach on November 16 at 4:38 PM, stating 'Please give us some time to address this issue satisfactorily.' On November 17, DEXX announced it had applied for judicial wallet marking and sought Solana Foundation assistance to freeze hacker addresses. The platform also posted a public message addressing the attacker as 'Mr./Ms. Hacker,' offering to destroy investigative information and refrain from legal action if funds were returned — an offer the hacker did not accept. Whether the incident constitutes an external hack or potential insider theft has not been definitively resolved by any credible investigation at time of writing.","heading":"The Hack","sources":[{"url":"https://en.theblockbeats.news/news/55791","name":"","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2152340","name":"","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=dexx-losses","name":"","type":"other","credibility":3},{"url":"https://www.ellipal.com/blogs/news/dexx-exposed-the-importance-of-true-decentralized-wallets","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain security firm SlowMist conducted the primary on-chain investigation and published findings on November 28, 2024. SlowMist identified 8,612 unique Solana wallet addresses linked to attacker activity, with 8,848 victim addresses on the Solana chain and an additional 7,205 on EVM-compatible chains (Ethereum, BSC, and Base). The attacker converted stolen token balances into SOL on Solana before bridging funds cross-chain via Wormhole to Ethereum, then converting into ETH and BNB. Beginning in early December 2024, the attacker began depositing ETH into Tornado Cash, the sanctioned privacy mixer, to obscure the transaction trail. Scam Sniffer monitoring recorded approximately 1,000 ETH deposited into Tornado Cash in initial transfers; subsequent reporting tracked over 4,700 ETH moved through the mixer in later batches, with SlowMist's Cosine noting an additional 300 ETH batch on approximately December 10, 2024. The primary EVM attacker address identified by SlowMist (0xFFB9...8228) held residual balances distributed across Ethereum, BSC, and Base. Two primary Solana attacker addresses (4smi8...HLd and GPuNX...RKgt) held comparatively small residual balances. Total losses were initially reported at $21 million but revised upward to approximately $30 million by SlowMist, with the difference attributable to price volatility in the meme tokens stolen.","heading":"On-Chain Evidence","sources":[{"url":"https://bravenewcoin.com/insights/dexx-hack-investigation-unveils-over-8600-solana-wallet-links-slowmist-report","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/solana-dexx-hack-november-2024-suspicious-wallets","name":"","type":"other","credibility":3},{"url":"https://blockchain.news/flashnews/dexx-hacker-transfers-4700-eth-to-tornado-cash","name":"","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2156116","name":"","type":"other","credibility":3},{"url":"https://onekey.so/blog/ecosystem/what-does-it-mean-when-dexx-funds-are-all-laundered-through-tornado-cash/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"At least 900 unique users reported losses, though the actual affected population may be larger given the 8,600+ wallets identified by SlowMist. The majority of victims lost less than $10,000, consistent with retail memecoin traders. At least one individual suffered losses exceeding $1 million. GoPlus Security issued a warning on November 16, 2024 cautioning affected users against secondary scams — phishing schemes specifically targeting DEXX victims by soliciting private key uploads under the guise of compensation recovery. The total loss estimate of $30 million reflects valuations at time of theft, with meme token price volatility creating uncertainty in the final figure. The incident represented the second-largest hack by dollar volume in November 2024, trailing only the $25.5 million Thala Labs exploit — the key distinction being that Thala recovered all stolen assets, while DEXX did not. Unlike exchange hacks where assets are custodied institutionally, users in this case believed they were operating self-custodial wallets, making the psychological and trust impact particularly acute.","heading":"User Impact","sources":[{"url":"https://www.cryptopolitan.com/8620-solana-wallets-linked-to-the-dexx-hack/","name":"","type":"other","credibility":3},{"url":"https://financefeeds.com/8600-solana-addresses-linked-to-dexx-hack-total-losses-rise-to-30m/","name":"","type":"other","credibility":3},{"url":"https://www.thecoinrepublic.com/2024/11/30/30m-dexx-hack-linked-to-8600-solana-wallets/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"DEXX announced a formal compensation portal on December 14, 2024, and allocated 80% of daily platform revenue toward victim repayment. A compensation NFT staking mechanism was launched on February 5, 2025. On February 8, 2025, LBank announced it was leading a seven-party coalition — including MEXC Ventures, HashKey Capital, SevenX Ventures, and Mask Network — in a $15 million donation initiative toward user compensation. The Meme Prosperity Committee, co-established by LBank and MEXC Ventures, was formed to oversee distribution. By February 18, 2025, more than 3,000 addresses had received compensation payments, representing partial progress. The compensation mechanism incorporates manual review, on-chain data verification, and user identity matching. As of the time of writing, no stolen funds have been recovered from the attacker. The hacker's extensive use of Tornado Cash to launder ETH makes tracing and clawback highly unlikely. No arrests or charges against any identified suspect in the DEXX breach have been publicly reported by law enforcement. The $15 million coalition pledge covers roughly half the estimated $30 million in losses, and the final shortfall distribution methodology had not been publicly confirmed.","heading":"Recovery","sources":[{"url":"https://decrypt.co/306495/lbank-reveals-dexx-compensation-process-and-enhancing-crypto-and-meme-innovation","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/305132/lbank-lead-seven-party-coalition-in-15-million-donation-drive-for-dexx-compensation","name":"","type":"other","credibility":3},{"url":"https://www.panewslab.com/en/articles/b0qi6kty","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"DEXX presents a critical risk profile for users considering the platform. The core architectural defect — centralized server-side storage of user private keys transmitted in plaintext — was identified and documented by CertiK prior to the breach with a failing audit score of 59.31, yet was not remediated. This represents a fundamental contradiction between the platform's non-custodial marketing and its actual technical custody model, a pattern that removed users' ability to make informed security decisions. The coordinated, multi-address nature of the attack (each victim corresponding to a distinct attacker address) suggests either sophisticated pre-meditated external intrusion or insider access to the private key database. Neither scenario has been definitively established by investigators. The attacker's systematic use of Wormhole cross-chain bridging and Tornado Cash mixing indicates familiarity with blockchain forensics evasion, substantially reducing the probability of fund recovery. No regulatory action, law enforcement charges, or court filings related to DEXX have been identified in available sources. The partial compensation initiative is contingent on third-party donations and platform revenue rather than recovered stolen funds, meaning full restitution is structurally improbable. Users who hold assets on DEXX or similar platforms that take custody of private keys should treat those assets as at material risk of total loss.","heading":"Risk Assessment","sources":[{"url":"https://www.chaincatcher.com/en/article/2152340","name":"","type":"other","credibility":3},{"url":"https://blog.bitrace.io/dexx-incident-inspiration-understanding-crypto-custody-risks/","name":"","type":"other","credibility":3},{"url":"https://www.coinglass.com/learn/dexx-scandal-en","name":"","type":"other","credibility":3},{"url":"https://skynet.certik.com/projects/dexx","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-11-16","event":"DEXX private key breach begins; user assets across 8,600+ Solana wallets start draining in early morning hours","source":""},{"date":"2024-11-16","event":"CertiK confirms breach on Solana blockchain, attributes cause to improper private key management by DEXX platform","source":""},{"date":"2024-11-16","event":"DEXX founder Roy publicly acknowledges incident, asks for time to address the issue","source":""},{"date":"2024-11-16","event":"GoPlus Security warns DEXX victims of secondary phishing scams soliciting private key uploads","source":""},{"date":"2024-11-17","event":"DEXX applies for judicial wallet marking and requests Solana Foundation assistance to freeze hacker addresses","source":""},{"date":"2024-11-28","event":"SlowMist publishes investigation linking 8,612 Solana wallet addresses to attacker; total losses revised to $30 million","source":""},{"date":"2024-12-02","event":"SlowMist reveals EVM chain victim and attacker addresses, expanding scope to 7,205 EVM wallets","source":""},{"date":"2024-12-09","event":"Attacker begins depositing stolen ETH into Tornado Cash; initial transfers of approximately 1,000 ETH reported","source":""},{"date":"2024-12-09","event":"DEXX hacker transfers 4,700 ETH to Tornado Cash in a single batch","source":""},{"date":"2024-12-10","event":"Additional 300 ETH batch transferred to Tornado Cash by DEXX attacker; SlowMist founder Cosine confirms","source":""},{"date":"2024-12-14","event":"DEXX launches formal compensation portal for affected users","source":""},{"date":"2025-02-05","event":"DEXX opens compensation NFT staking portal, allowing affected users to participate in repayment scheme","source":""},{"date":"2025-02-08","event":"LBank announces $15 million seven-party coalition donation initiative for DEXX user compensation","source":""},{"date":"2025-02-18","event":"LBank reports more than 3,000 addresses have received compensation payments; compensation process at approximately 30% completion","source":""}],"sources_used":[{"url":"https://skynet.certik.com/projects/dexx","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829040926/https://skynet.certik.com/projects/dexx","credibility":3,"archive_timestamp":"2026-08-29T04:09:26+00:00"},{"url":"https://www.chaincatcher.com/en/article/2152340","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coinglass.com/learn/dexx-scandal-en","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829085108/https://www.coinglass.com/learn/dexx-scandal-en","credibility":3,"archive_timestamp":"2026-08-29T08:51:08+00:00"},{"url":"https://en.theblockbeats.news/news/55791","name":"","type":"other","archive_url":"http://web.archive.org/web/20260117052912/https://en.theblockbeats.news/news/55791","credibility":3,"archive_timestamp":"2026-01-17T05:29:12+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=dexx-losses","name":"","type":"other","archive_url":"http://web.archive.org/web/20260307235621/https://www.web3isgoinggreat.com/?id=dexx-losses","credibility":3,"archive_timestamp":"2026-03-07T23:56:21+00:00"},{"url":"https://www.ellipal.com/blogs/news/dexx-exposed-the-importance-of-true-decentralized-wallets","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bravenewcoin.com/insights/dexx-hack-investigation-unveils-over-8600-solana-wallet-links-slowmist-report","name":"","type":"other","archive_url":"http://web.archive.org/web/20260121123408/https://bravenewcoin.com/insights/dexx-hack-investigation-unveils-over-8600-solana-wallet-links-slowmist-report","credibility":3,"archive_timestamp":"2026-01-21T12:34:08+00:00"},{"url":"https://cointelegraph.com/news/solana-dexx-hack-november-2024-suspicious-wallets","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://blockchain.news/flashnews/dexx-hacker-transfers-4700-eth-to-tornado-cash","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.chaincatcher.com/en/article/2156116","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://onekey.so/blog/ecosystem/what-does-it-mean-when-dexx-funds-are-all-laundered-through-tornado-cash/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251213171915/https://onekey.so/blog/ecosystem/what-does-it-mean-when-dexx-funds-are-all-laundered-through-tornado-cash/","credibility":3,"archive_timestamp":"2025-12-13T17:19:15+00:00"},{"url":"https://www.cryptopolitan.com/8620-solana-wallets-linked-to-the-dexx-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251209075501/https://www.cryptopolitan.com/8620-solana-wallets-linked-to-the-dexx-hack/","credibility":3,"archive_timestamp":"2025-12-09T07:55:01+00:00"},{"url":"https://financefeeds.com/8600-solana-addresses-linked-to-dexx-hack-total-losses-rise-to-30m/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829225911/https://financefeeds.com/8600-solana-addresses-linked-to-dexx-hack-total-losses-rise-to-30m/","credibility":3,"archive_timestamp":"2026-08-29T22:59:11+00:00"},{"url":"https://www.thecoinrepublic.com/2024/11/30/30m-dexx-hack-linked-to-8600-solana-wallets/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251016230635/https://www.thecoinrepublic.com/2024/11/30/30m-dexx-hack-linked-to-8600-solana-wallets/","credibility":3,"archive_timestamp":"2025-10-16T23:06:35+00:00"},{"url":"https://decrypt.co/306495/lbank-reveals-dexx-compensation-process-and-enhancing-crypto-and-meme-innovation","name":"","type":"other","archive_url":"http://web.archive.org/web/20260610093523/https://decrypt.co/306495/lbank-reveals-dexx-compensation-process-and-enhancing-crypto-and-meme-innovation","credibility":3,"archive_timestamp":"2026-06-10T09:35:23+00:00"},{"url":"https://decrypt.co/305132/lbank-lead-seven-party-coalition-in-15-million-donation-drive-for-dexx-compensation","name":"","type":"other","archive_url":"http://web.archive.org/web/20260516143513/https://decrypt.co/305132/lbank-lead-seven-party-coalition-in-15-million-donation-drive-for-dexx-compensation","credibility":3,"archive_timestamp":"2026-05-16T14:35:13+00:00"},{"url":"https://www.panewslab.com/en/articles/b0qi6kty","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://blog.bitrace.io/dexx-incident-inspiration-understanding-crypto-custody-risks/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260211090033/https://blog.bitrace.io/dexx-incident-inspiration-understanding-crypto-custody-risks/","credibility":3,"archive_timestamp":"2026-02-11T09:00:33+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:27.650282+00:00","updated_at":"2026-08-29T23:26:13.729859+00:00"}}