{"investigation":{"slug":"phemex","entity_name":"Phemex","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Phemex is a centralized cryptocurrency derivatives exchange founded in November 2019 by former Morgan Stanley executives and registered in the British Virgin Islands. In January 2025, the exchange suffered one of the largest crypto hacks of that year, with an estimated $69–85 million drained from hot wallets across 16 blockchains, subsequently attributed to North Korea's Lazarus Group through on-chain evidence linking the same wallets to the February 2025 Bybit hack. Phemex has also faced formal regulatory enforcement actions in Ontario, Canada, and operates without authorization in the United Kingdom.","sections":[{"content":"Phemex was founded in November 2019 by Jack Tao and a team of eight former Morgan Stanley executives. The company is incorporated as Phemex Limited in the British Virgin Islands, with a related entity Phemex Technology Pte. Ltd. managing mobile trading infrastructure. The platform quickly scaled to serve over 10 million users globally, reaching peak daily trading volumes exceeding $12 billion and briefly ranking among the top 10 global derivatives exchanges. The exchange positions itself as a zero-fee spot trading and derivatives platform with a focus on users in Eastern Europe, Latin America, the Middle East, North Africa, and Southeast Asia. Phemex's CEO following the January 2025 hack was identified in public communications as Federico Variola.","heading":"Background","sources":[{"url":"https://cointelegraph.com/news/from-morgan-stanley-to-crypto-world-in-a-conversation-with-phemex-founder","name":"","type":"other","credibility":3},{"url":"https://en.everybodywiki.com/Phemex","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 23, 2025, at approximately 11:30 UTC, Phemex detected unauthorized access to its hot wallets. The attacker systematically drained funds across sixteen blockchains in a highly coordinated operation, converting freezable stablecoins such as USDT and USDC into non-freezable assets like ETH to evade potential blacklisting. Blockchain security firm Cyvers identified approximately 125 suspicious transactions during the incident. Reported total losses vary by source: early estimates placed the figure at $29 million; subsequent analyses by firms including Halborn and Merkle Science revised this to approximately $69–85 million, with the most commonly cited figure being around $73 million. Phemex's CEO published a Proof of Reserves shortly after the breach to demonstrate cold wallet solvency and issued a compensation plan for affected users. Deposits and withdrawals for most chains were suspended on January 23, 2025, at 15:13 UTC. Full withdrawal services were restored by early February 2025. The attack vector was identified as compromised private keys, likely stored inadequately across multiple hot wallet environments — a pattern consistent with prior Lazarus Group intrusions. The Lazarus Group, a North Korean state-sponsored threat actor, was formally linked to the Phemex hack on February 22, 2025, when on-chain investigator ZachXBT publicly identified that Lazarus Group commingled funds from both the Phemex theft and the $1.4 billion Bybit hack (which occurred on February 21, 2025) at the same Ethereum address: 0x33d057af74779925c4b2e720a820387cb89f8f65. Blockchain intelligence firm Arkham Intelligence corroborated this attribution.","heading":"The Lazarus Hack","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-phemex-hack-january-2025","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/lazarus-group-consolidates-bybit-phemex-hacker-wallet","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2025/01/23/crypto-exchange-phemex-investigating-hack-reports-as-usd29m-drained-from-hot-wallets","name":"","type":"other","credibility":3},{"url":"https://x.com/zachxbt/status/1893211577836302365","name":"","type":"other","credibility":3},{"url":"https://beincrypto.com/phemex-hack-hot-wallets-exploit/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Post-incident blockchain analysis by Merkle Science, Cyvers, Hacken, and ZachXBT documented the flow of stolen funds across 14 chains during the initial laundering phase. Documented amounts per chain include: Ethereum ($20.9M), Solana ($13.6M and an additional $1.6M), XRP ($13.4M), Bitcoin ($5.3M), Dogecoin ($3.8M), BNB Smart Chain ($2.4M), Base ($1.9M via Stargate Finance bridge to ETH), Arbitrum ($1.038M), Avalanche ($1.09M), Cardano ($2.5M), Optimism ($500K), Polygon ($680K), and Litecoin ($1.2M). Stolen stablecoins were rapidly converted to ETH to circumvent freezing mechanisms. On February 19, 2025, blockchain analytics firm Global Ledger identified that over 2,080 ETH (approximately $6 million) was transferred to 14 new wallets and routed through Tornado Cash, the eXch mixer, Wintermute, DLN Trade protocol, and THORChain. The on-chain commingling of Phemex and Bybit hack proceeds at Ethereum address 0x33d057af74779925c4b2e720a820387cb89f8f65, identified by ZachXBT on February 22, 2025, constitutes the primary direct attribution evidence linking the Phemex incident to the Lazarus Group. Arkham Intelligence and Hacken separately corroborated the Lazarus Group attribution based on the systematic multi-chain draining methodology and obfuscation patterns consistent with prior DPRK-linked hacks including the $600 million Ronin Network exploit.","heading":"On-Chain Evidence","sources":[{"url":"https://www.merklescience.com/blog/hack-track-phemex-flow-of-funds-analysis","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer","name":"","type":"other","credibility":3},{"url":"https://x.com/zachxbt/status/1893211577836302365","name":"","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/crypto-hacks-surge-phemex-breach-tops-69m-2501101063ec4bcbbd767285/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Phemex's regulatory record is mixed and includes formal enforcement action. In Ontario, Canada, the Capital Markets Tribunal found on December 18, 2024 (citation: Phemex Limited (Re), 2024 ONCMT 30) that Phemex Limited and Phemex Technology Pte. Ltd. operated an unregistered crypto asset trading platform and sold securities to Ontario residents without registration or prospectus exemptions between November 25, 2019 and January 6, 2023. The Tribunal found that at least 117 Ontario investors traded over 74 million USDT in securities on the platform. Phemex implemented IP-based blocks on Ontario users only after being contacted by the Ontario Securities Commission (OSC) on January 7, 2023. Both entities were permanently banned from participating in Ontario's capital markets. A separate sanctions hearing was ordered. The UK Financial Conduct Authority (FCA) lists Phemex as an unauthorized firm, warning that it may be promoting financial services in the UK without FCA approval. Phemex does hold regulatory registrations in a number of other jurisdictions including AUSTRAC registration in Australia, OAM registration in Italy, Ministry of Finance VASP registration in Poland, and a securities-related license in Lithuania under Phemex Lithuania UAB. The exchange explicitly restricts access to U.S. residents in its terms of service and does not hold registration with U.S. financial regulators for customer-facing services.","heading":"Regulatory Status","sources":[{"url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024","name":"","type":"other","credibility":3},{"url":"https://www.osc.ca/en/news-events/news/osc-continues-hold-non-compliant-crypto-asset-trading-platforms-accountable","name":"","type":"other","credibility":3},{"url":"https://fintelegram.com/attention-regulatory-enforcement-proceedings-against-crypto-exchange-phemex/","name":"","type":"other","credibility":3},{"url":"https://www.bitget.com/amp/academy/phemex-us-legal","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the January 23, 2025 hack, Phemex immediately suspended deposits and withdrawals for all chains except Bitcoin and Ethereum, and subsequently halted BTC and ETH withdrawals as well. Trading services remained operational during this period. The exchange's CEO, Federico Variola, published a Proof of Reserves link via social media to demonstrate cold wallet solvency and assured users that cold wallets were unaffected. Phemex issued a compensation plan for impacted users. Full withdrawal functionality was restored by early February 2025, approximately 10 days after the breach. The Ontario Capital Markets Tribunal separately found that at least 117 Ontario-based investors were directly harmed through the platform's unregistered securities activity, trading in excess of 74 million USDT. Users in the United Kingdom have no recourse through domestic regulatory frameworks given the FCA's unauthorized firm designation. The exchange's voluntary reimbursement commitments were not backed by a regulated guarantee scheme or third-party insurance, leaving users reliant on the exchange's self-reported proof of reserves and discretionary compensation.","heading":"User Impact","sources":[{"url":"https://cryptoslate.com/phemex-reassures-users-with-a-compensation-plan-after-37-million-hot-wallet-breach/","name":"","type":"other","credibility":3},{"url":"https://phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timeline","name":"","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/01/23/phemex-exchange-hacked-29m-stolen-withdrawals-suspended/","name":"","type":"other","credibility":3},{"url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Phemex presents a critical risk profile across multiple dimensions. Security: The January 2025 hack demonstrated a systemic failure in private key management across 16 blockchains simultaneously — a core custodial function for any exchange. Attribution to the Lazarus Group, if confirmed by law enforcement, would place the hack among the most sophisticated state-sponsored crypto thefts in history. The subsequent linking of Phemex hack proceeds with the $1.4 billion Bybit hack via shared Lazarus wallets reinforces the severity of the breach. The use of Tornado Cash and multiple mixers to launder funds suggests the stolen assets are unlikely to be recoverable. Regulatory: Phemex has received a permanent capital markets ban in Ontario following a formal tribunal ruling, and operates without FCA authorization in the UK. The lack of major-jurisdiction licensing (U.S., UK) limits recourse for a large proportion of potential users. Operational Transparency: Compensation commitments made after the hack were discretionary and not backed by regulated deposit protection. Proof of reserves claims, while published, are not independently audited in real time. Taken together, these factors — a confirmed nine-figure hack by a state-sponsored actor, permanent regulatory bans in two major jurisdictions, and a hot wallet security architecture that proved catastrophically inadequate — place Phemex in the highest risk tier for retail users.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-phemex-hack-january-2025","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/lazarus-group-consolidates-bybit-phemex-hacker-wallet","name":"","type":"other","credibility":3},{"url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2019-11","event":"Phemex founded by Jack Tao and seven other former Morgan Stanley executives; incorporated in the British Virgin Islands.","source":"","date_original":"2019-11-01"},{"date":"2021","event":"UK Financial Conduct Authority designates Phemex as an unauthorized firm operating without FCA approval.","source":"","date_original":"2021-01-01"},{"date":"2023-01-07","event":"Phemex implements IP-based blocks on Ontario users after being contacted by the Ontario Securities Commission.","source":""},{"date":"2024-12-18","event":"Ontario Capital Markets Tribunal rules in Phemex Limited (Re), 2024 ONCMT 30 that Phemex operated an unregistered securities trading platform in Ontario; both entities permanently banned from Ontario capital markets.","source":""},{"date":"2025-01-23","event":"Phemex hot wallets drained across 16 blockchains; estimated $69–85 million stolen. Withdrawals suspended at 15:13 UTC. PeckShield and Cyvers flag approximately 125 suspicious transactions.","source":""},{"date":"2025-01-24","event":"Phemex CEO publishes Proof of Reserves and issues compensation plan. Security firms Halborn, Merkle Science, and Hacken begin on-chain analysis; Lazarus Group suspected.","source":""},{"date":"2025-02","event":"Phemex restores full withdrawal services approximately 10 days after the breach.","source":"","date_original":"2025-02-01"},{"date":"2025-02-19","event":"Global Ledger identifies 2,080+ ETH from Phemex hack routed through Tornado Cash, eXch mixer, THORChain, and Wintermute.","source":""},{"date":"2025-02-21","event":"Bybit suffers $1.4 billion hack, subsequently attributed to Lazarus Group.","source":""},{"date":"2025-02-22","event":"ZachXBT publicly identifies on-chain commingling of Phemex and Bybit hack proceeds at Ethereum address 0x33d057af74779925c4b2e720a820387cb89f8f65, directly linking both hacks to Lazarus Group.","source":""}],"sources_used":[{"url":"https://cointelegraph.com/news/from-morgan-stanley-to-crypto-world-in-a-conversation-with-phemex-founder","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://en.everybodywiki.com/Phemex","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-phemex-hack-january-2025","name":"","type":"other","archive_url":"http://web.archive.org/web/20260727012754/https://www.halborn.com/blog/post/explained-the-phemex-hack-january-2025","credibility":3,"archive_timestamp":"2026-07-27T01:27:54+00:00"},{"url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer","name":"","type":"other","archive_url":"http://web.archive.org/web/20251120001638/https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer","credibility":3,"archive_timestamp":"2025-11-20T00:16:38+00:00"},{"url":"https://cointelegraph.com/news/lazarus-group-consolidates-bybit-phemex-hacker-wallet","name":"","type":"other","archive_url":"http://web.archive.org/web/20260305173051/https://cointelegraph.com/news/lazarus-group-consolidates-bybit-phemex-hacker-wallet","credibility":3,"archive_timestamp":"2026-03-05T17:30:51+00:00"},{"url":"https://www.coindesk.com/business/2025/01/23/crypto-exchange-phemex-investigating-hack-reports-as-usd29m-drained-from-hot-wallets","name":"","type":"other","archive_url":"https://web.archive.org/web/20260916003845/https://www.coindesk.com/business/2025/01/23/crypto-exchange-phemex-investigating-hack-reports-as-usd29m-drained-from-hot-wallets","credibility":3,"archive_timestamp":"2026-09-16T00:38:45+00:00"},{"url":"https://x.com/zachxbt/status/1893211577836302365","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://beincrypto.com/phemex-hack-hot-wallets-exploit/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.merklescience.com/blog/hack-track-phemex-flow-of-funds-analysis","name":"","type":"other","archive_url":"http://web.archive.org/web/20260610222155/https://www.merklescience.com/blog/hack-track-phemex-flow-of-funds-analysis","credibility":3,"archive_timestamp":"2026-06-10T22:21:55+00:00"},{"url":"https://www.ainvest.com/news/crypto-hacks-surge-phemex-breach-tops-69m-2501101063ec4bcbbd767285/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024","name":"","type":"other","archive_url":"http://web.archive.org/web/20260113021714/https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024","credibility":3,"archive_timestamp":"2026-01-13T02:17:14+00:00"},{"url":"https://www.osc.ca/en/news-events/news/osc-continues-hold-non-compliant-crypto-asset-trading-platforms-accountable","name":"","type":"other","archive_url":"http://web.archive.org/web/20251209004106/https://www.osc.ca/en/news-events/news/osc-continues-hold-non-compliant-crypto-asset-trading-platforms-accountable","credibility":3,"archive_timestamp":"2025-12-09T00:41:06+00:00"},{"url":"https://fintelegram.com/attention-regulatory-enforcement-proceedings-against-crypto-exchange-phemex/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260419085113/https://fintelegram.com/attention-regulatory-enforcement-proceedings-against-crypto-exchange-phemex/","credibility":3,"archive_timestamp":"2026-04-19T08:51:13+00:00"},{"url":"https://www.bitget.com/amp/academy/phemex-us-legal","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptoslate.com/phemex-reassures-users-with-a-compensation-plan-after-37-million-hot-wallet-breach/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260829075251/https://cryptoslate.com/phemex-reassures-users-with-a-compensation-plan-after-37-million-hot-wallet-breach/","credibility":3,"archive_timestamp":"2026-08-29T07:52:51+00:00"},{"url":"https://phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timeline","name":"","type":"other","archive_url":"http://web.archive.org/web/20260518180909/https://phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timeline","credibility":3,"archive_timestamp":"2026-05-18T18:09:09+00:00"},{"url":"https://www.cryptotimes.io/2025/01/23/phemex-exchange-hacked-29m-stolen-withdrawals-suspended/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251007215251/https://www.cryptotimes.io/2025/01/23/phemex-exchange-hacked-29m-stolen-withdrawals-suspended/","credibility":3,"archive_timestamp":"2025-10-07T21:52:51+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:26.063937+00:00","updated_at":"2026-09-16T00:39:58.346556+00:00"}}