{"investigation":{"slug":"woo-x","entity_name":"WOO X","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"WOO X is a centralized cryptocurrency exchange founded in 2019 and incubated by Taiwanese quantitative trading firm Kronos Research, offering spot and derivatives trading with a focus on deep liquidity and low fees. The exchange has experienced two significant security events: a November 2023 liquidity crisis triggered by a $26 million hack of its primary market maker Kronos Research, and a July 2025 $14 million breach of nine user accounts attributed to a North Korean state-sponsored group (UNC4899/Lazarus) via phishing of a developer. Both incidents resulted in user compensation from company reserves, though the pattern of security failures and structural dependency on Kronos Research represent elevated counterparty and operational risk.","sections":[{"content":"WOO X is a centralized cryptocurrency exchange incorporated in Seychelles and founded in 2019 by Jack Tan and Mark Pimentel, who are co-founders of Kronos Research, a Taiwanese quantitative high-frequency trading firm. The exchange launched publicly in August 2021 and positioned itself as the first crypto exchange to use a Payment for Order Flow (PFOF) model. WOO X offers spot and perpetual futures trading with fee structures that can reach zero for high-volume users, sourcing liquidity primarily by aggregating order books from major exchanges and through market makers including Kronos Research. Average daily volume has historically exceeded $600 million. In October 2025, Web3 private equity fund FusionX Digital announced it would become the new operator of WOO X, with Sheldon Xia, founder of BitMart, joining a newly established Global Strategic Committee. The WOO token (WOO) serves as the platform's native utility token and is used for fee discounts and governance.","heading":"Background","sources":[{"url":"https://academy.binance.com/en/articles/what-is-woo-network-woo","name":"","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2025/10/15/3167430/0/en/Web-3-Private-Equity-Fund-FusionX-Digital-to-become-the-new-operator-of-WOO-X-plans-to-scale-centralized-exchange-while-growing-token-utility.html","name":"","type":"other","credibility":3},{"url":"https://www.kraken.com/learn/what-is-woo-network","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"WOO X was incubated by and remains structurally dependent on Kronos Research, the Taiwanese quantitative trading firm co-founded by WOO X's own founders Jack Tan and Mark Pimentel. Kronos Research served as the primary market maker for WOO X, accounting for approximately 40% of liquidity in WOO X perpetual futures markets at the time of the November 2023 incident. This dual role — as both incubator/backer and dominant liquidity provider — represents a significant conflict of interest and concentration risk. In August 2023, two disgruntled Kronos Research engineers were convicted by a Taipei court of tampering with trading algorithms after disputes over unpaid bonuses, causing an estimated $1.4 million in trading losses. This internal sabotage incident preceded the more serious November 2023 external hack by roughly three months. Following the November 2023 disruption, WOO X stated it would onboard additional market makers to reduce dependence on Kronos Research, though the extent of that diversification has not been independently audited.","heading":"Kronos Research Connection","sources":[{"url":"https://cointelegraph.com/news/kronos-research-halts-trading-25-m-hack-investigation","name":"","type":"other","credibility":3},{"url":"https://cryptonews.net/news/legal/21491729/","name":"","type":"other","credibility":3},{"url":"https://woox.io/en/blog/transparency-update-liquidity-incident-review","name":"","type":"other","credibility":3},{"url":"https://medium.com/@C137K/from-taiwan-to-the-world-stage-kronos-research-and-their-ascension-in-crypto-market-making-d92e08941d78","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"WOO X has experienced two material security incidents within a 20-month window, both resulting in temporary trading or withdrawal suspensions and user compensation from company reserves.\n\nNovember 2023 — Kronos Research API Hack: On November 18, 2023, Kronos Research disclosed that several of its exchange API keys had been compromised by an external attacker, resulting in approximately $26 million in losses. Because Kronos Research was the primary liquidity provider for WOO X, the exchange was forced to suspend trading and withdrawals. WOO X confirmed that the attacker withdrew approximately 6 million WOO tokens (~$1.25 million USD) and attempted a fourth withdrawal of $318,000 USDT that was blocked. The platform was offline for roughly two hours before partial restoration, with full service taking eleven hours to restore. WOO X reports that 227 users experienced liquidations due to the liquidity gap during the restart period, and stated all were compensated. Net outflows of approximately $13 million were processed over the following 48 hours. Kronos Research offered the hacker a 10% bounty and stated losses would be covered internally. The hacker subsequently laundered an estimated $4 million through Tornado Cash.\n\nJuly 2025 — Phishing Attack Attributed to North Korean Threat Actor: On July 24, 2025, WOO X detected unauthorized withdrawals across nine user accounts totaling $14 million across Bitcoin, Ethereum, BNB, and Arbitrum networks. WOO X's own post-mortem attributed the breach to UNC4899, a North Korean state-sponsored cyber espionage group aligned with the Reconnaissance General Bureau, publicly known as the Lazarus Group. The attack began on June 28, 2025, when a developer was approached via an open-source software forum under the guise of a collaboration request, then tricked into downloading malware onto a company-issued MacBook. The attacker remained dormant for approximately two weeks after gaining production environment access before executing withdrawals between 13:50 and 15:40 UTC+8 on July 24. WOO X detected the activity within two hours and suspended all withdrawals. The exchange stated 100% compensation was provided from WOO treasury reserves.\n\nAdditionally, throughout 2024, WOO X issued multiple notices of temporary withdrawal suspensions for specific assets including ORDER (Arbitrum), SUI, and TON tokens, though these appear to be routine network-level maintenance rather than security incidents.","heading":"Security History","sources":[{"url":"https://woox.io/en/blog/transparency-update-liquidity-incident-review","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/263638/taiwanese-trading-firm-kronos-research-hacked-for-estimated-25-million-zachxbt","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2023/11/28/crypto-trading-firm-kronos-research-offers-10-bounty-to-hacker","name":"","type":"other","credibility":3},{"url":"https://cryptonews.com/news/kronos-research-hacker-launders-4m-through-tornado-cash/","name":"","type":"other","credibility":3},{"url":"https://woox.io/blog/july-24th-security-incident-post-mortem","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-woo-x-hack-july-2025","name":"","type":"other","credibility":3},{"url":"https://yellow.com/news/woo-x-exchange-suspends-operations-after-dollar14-million-hack-targets-user-accounts","name":"","type":"other","credibility":3},{"url":"https://rekt.news/woox-rekt","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"WOO X is incorporated in Seychelles, a jurisdiction with historically light-touch crypto oversight. In September 2022, WOO Network became one of 24 crypto platforms approved by Taiwan's Financial Supervisory Commission (FSC) under the Money Laundering Control Act, making it the only foreign applicant in that initial approval cohort. The Taiwan AML registration requires the exchange to implement anti-money laundering and counter-terrorism financing measures and to maintain a separate Taiwan-facing application that does not offer futures or margin trading to Taiwanese users.\n\nThe Seychelles VASP Act 2024, which came into force on September 1, 2024, requires all crypto businesses operating from Seychelles to hold a VASP license from the Financial Services Authority (FSA). WOO X has not publicly disclosed the status of any Seychelles VASP license application. No enforcement actions, lawsuits, or regulatory sanctions by the US SEC, CFTC, or equivalent major regulators have been identified in available public records as of May 2026.\n\nWOO X maintains a self-reported Proof of Reserves dashboard updated every 15 minutes and has undergone Merkle tree-based monthly reserve audits. Third-party audits have historically been conducted by SecureVectors and TUV Rheinland, and the exchange holds an ISO/IEC 27001 information security certification. These disclosures are self-reported and not independently verified by this investigation.","heading":"Regulatory Status","sources":[{"url":"https://www.coindesk.com/policy/2022/09/08/taiwan-approves-24-crypto-platforms-including-woo-network-for-aml-compliance","name":"","type":"other","credibility":3},{"url":"https://woox.io/proof-of-reserves","name":"","type":"other","credibility":3},{"url":"https://woox.io/blog/woo-security-unveiled-keeping-your-assets-safe","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"WOO X presents a combination of structural and operational risk factors that collectively support an elevated risk rating.\n\nConcentration and Counterparty Risk: WOO X was founded by and structurally intertwined with Kronos Research, its primary market maker. The November 2023 incident demonstrated that a failure at Kronos Research could directly and severely disrupt WOO X operations, triggering platform-wide trading halts and user liquidations. Although WOO X stated it would diversify market makers after the incident, the degree of remaining dependence is not independently verifiable.\n\nRepeated Security Failures: WOO X has suffered two material security incidents in under two years — one external (API key compromise at Kronos Research, 2023) and one attributed to a sophisticated nation-state threat actor (North Korean UNC4899/Lazarus Group phishing, 2025). The July 2025 incident involved a multi-week undetected intrusion into the production environment, indicating gaps in runtime monitoring and access compartmentalization.\n\nOwnership Transition: The October 2025 acquisition of WOO X's centralized exchange operations by FusionX Digital, a Web3 private equity fund, introduces uncertainty regarding future governance, security practices, and user fund handling. FusionX Digital has limited public operating history.\n\nMitigating Factors: In both material incidents, WOO X compensated affected users from treasury reserves and did not socialize losses. The exchange maintains a public proof-of-reserves dashboard and holds ISO/IEC 27001 certification. Taiwan AML registration indicates some regulatory engagement. No regulatory enforcement actions have been identified.\n\nOverall, the combination of two security incidents within 20 months — including one involving a North Korean APT — structural dependency on a single market maker that itself suffered a $26 million breach, and a recent change of operator with limited public track record, results in a materially elevated risk profile for retail users.","heading":"Risk Assessment","sources":[{"url":"https://woox.io/blog/july-24th-security-incident-post-mortem","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-woo-x-hack-july-2025","name":"","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2025/10/15/3167430/0/en/Web-3-Private-Equity-Fund-FusionX-Digital-to-become-the-new-operator-of-WOO-X-plans-to-scale-centralized-exchange-while-growing-token-utility.html","name":"","type":"other","credibility":3},{"url":"https://beincrypto.com/kronos-crypto-hack-suspends-trading/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018","event":"Kronos Research founded in Taiwan as a quantitative high-frequency trading firm by Jack Tan and Mark Pimentel.","source":"","date_original":"2018-01-01"},{"date":"2019","event":"WOO Network founded by Kronos Research co-founders Jack Tan and Mark Pimentel, incubated by Kronos Research.","source":"","date_original":"2019-01-01"},{"date":"2021-08","event":"WOO X launches publicly as a centralized exchange, billing itself as the first crypto exchange to use a Payment for Order Flow model.","source":"","date_original":"2021-08-01"},{"date":"2022-09-08","event":"WOO Network receives AML registration approval from Taiwan's Financial Supervisory Commission, the only foreign applicant among 24 approved platforms.","source":""},{"date":"2023-08","event":"Two Kronos Research engineers are convicted by a Taipei court of tampering with trading algorithms over unpaid bonuses, causing approximately $1.4 million in losses.","source":"","date_original":"2023-08-01"},{"date":"2023-11-18","event":"Kronos Research's exchange API keys are compromised by an external attacker; approximately $26 million is stolen. WOO X suspends trading and withdrawals due to Kronos being its primary market maker.","source":""},{"date":"2023-11-19","event":"WOO X restores spot and perpetual trading after onboarding alternative market makers. Exchange confirms 227 users experienced liquidations and states all will be compensated.","source":""},{"date":"2023-11-28","event":"Kronos Research publicly offers the hacker a 10% bounty to return funds. The offer is not accepted.","source":""},{"date":"2024-09","event":"Seychelles VASP Act 2024 comes into force, requiring all crypto businesses operating from Seychelles to hold a VASP license. WOO X's compliance status with this requirement is not publicly confirmed.","source":"","date_original":"2024-09-01"},{"date":"2025-06-28","event":"Alleged initial contact by UNC4899/Lazarus Group threat actor with a WOO X developer via open-source software forum, beginning the attack chain that leads to the July 2025 breach.","source":""},{"date":"2025-07-24","event":"WOO X detects unauthorized withdrawals of $14 million from nine user accounts across Bitcoin, Ethereum, BNB, and Arbitrum networks. Withdrawals are suspended. Attack attributed to North Korean state-sponsored group UNC4899.","source":""},{"date":"2025-07-25","event":"WOO X confirms $14 million in losses and pledges 100% compensation from WOO treasury reserves. Trading remains operational throughout incident.","source":""},{"date":"2025-10-15","event":"FusionX Digital, a Web3 private equity fund, announced as new operator of WOO X centralized exchange. Sheldon Xia, founder of BitMart, joins a newly established Global Strategic Committee.","source":""}],"sources_used":[{"url":"https://academy.binance.com/en/articles/what-is-woo-network-woo","name":"","type":"other","archive_url":"http://web.archive.org/web/20251009073544/https://academy.binance.com/en/articles/what-is-woo-network-woo","credibility":3,"archive_timestamp":"2025-10-09T07:35:44+00:00"},{"url":"https://www.globenewswire.com/news-release/2025/10/15/3167430/0/en/Web-3-Private-Equity-Fund-FusionX-Digital-to-become-the-new-operator-of-WOO-X-plans-to-scale-centralized-exchange-while-growing-token-utility.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20251108120800/https://www.globenewswire.com/news-release/2025/10/15/3167430/0/en/Web-3-Private-Equity-Fund-FusionX-Digital-to-become-the-new-operator-of-WOO-X-plans-to-scale-centralized-exchange-while-growing-token-utility.html","credibility":3,"archive_timestamp":"2025-11-08T12:08:00+00:00"},{"url":"https://www.kraken.com/learn/what-is-woo-network","name":"","type":"other","archive_url":"http://web.archive.org/web/20260718183605/https://www.kraken.com/learn/what-is-woo-network","credibility":3,"archive_timestamp":"2026-07-18T18:36:05+00:00"},{"url":"https://cointelegraph.com/news/kronos-research-halts-trading-25-m-hack-investigation","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829113642/https://cointelegraph.com/news/kronos-research-halts-trading-25-m-hack-investigation","credibility":3,"archive_timestamp":"2026-08-29T11:36:42+00:00"},{"url":"https://cryptonews.net/news/legal/21491729/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829113848/https://cryptonews.net/news/legal/21491729/","credibility":3,"archive_timestamp":"2026-08-29T11:38:48+00:00"},{"url":"https://woox.io/en/blog/transparency-update-liquidity-incident-review","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829042332/https://woox.io/en/blog/transparency-update-liquidity-incident-review","credibility":3,"archive_timestamp":"2026-08-29T04:23:32+00:00"},{"url":"https://medium.com/@C137K/from-taiwan-to-the-world-stage-kronos-research-and-their-ascension-in-crypto-market-making-d92e08941d78","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/263638/taiwanese-trading-firm-kronos-research-hacked-for-estimated-25-million-zachxbt","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/markets/2023/11/28/crypto-trading-firm-kronos-research-offers-10-bounty-to-hacker","name":"","type":"other","archive_url":"http://web.archive.org/web/20250905212710/https://www.coindesk.com/markets/2023/11/28/crypto-trading-firm-kronos-research-offers-10-bounty-to-hacker","credibility":3,"archive_timestamp":"2025-09-05T21:27:10+00:00"},{"url":"https://cryptonews.com/news/kronos-research-hacker-launders-4m-through-tornado-cash/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://woox.io/blog/july-24th-security-incident-post-mortem","name":"","type":"other","archive_url":"http://web.archive.org/web/20260517184242/https://woox.io/blog/july-24th-security-incident-post-mortem","credibility":3,"archive_timestamp":"2026-05-17T18:42:42+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-woo-x-hack-july-2025","name":"","type":"other","archive_url":"http://web.archive.org/web/20260516234510/https://www.halborn.com/blog/post/explained-the-woo-x-hack-july-2025","credibility":3,"archive_timestamp":"2026-05-16T23:45:10+00:00"},{"url":"https://yellow.com/news/woo-x-exchange-suspends-operations-after-dollar14-million-hack-targets-user-accounts","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829052716/https://yellow.com/news/woo-x-exchange-suspends-operations-after-dollar14-million-hack-targets-user-accounts","credibility":3,"archive_timestamp":"2026-08-29T05:27:16+00:00"},{"url":"https://rekt.news/woox-rekt","name":"","type":"other","archive_url":"http://web.archive.org/web/20260608194837/https://rekt.news/woox-rekt","credibility":3,"archive_timestamp":"2026-06-08T19:48:37+00:00"},{"url":"https://www.coindesk.com/policy/2022/09/08/taiwan-approves-24-crypto-platforms-including-woo-network-for-aml-compliance","name":"","type":"other","archive_url":"http://web.archive.org/web/20251213220253/https://www.coindesk.com/policy/2022/09/08/taiwan-approves-24-crypto-platforms-including-woo-network-for-aml-compliance","credibility":3,"archive_timestamp":"2025-12-13T22:02:53+00:00"},{"url":"https://woox.io/proof-of-reserves","name":"","type":"other","archive_url":"http://web.archive.org/web/20260825040500/https://woox.io/proof-of-reserves","credibility":3,"archive_timestamp":"2026-08-25T04:05:00+00:00"},{"url":"https://woox.io/blog/woo-security-unveiled-keeping-your-assets-safe","name":"","type":"other","archive_url":"http://web.archive.org/web/20251215135309/https://woox.io/blog/woo-security-unveiled-keeping-your-assets-safe","credibility":3,"archive_timestamp":"2025-12-15T13:53:09+00:00"},{"url":"https://beincrypto.com/kronos-crypto-hack-suspends-trading/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:22.199814+00:00","updated_at":"2026-08-30T03:54:59.482541+00:00"}}