Skip to main content
AVOID.NET

CoinEx

avoid.net/coinex→66/100·82% conf.

Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: Daily Hodl confirms CoinEx orderly wind-down, withdrawals to 22 Dec 2026, 5% monthly custody fee, reserve ratio over 100%. Neutral context for CoinEx; no score change. Trust score now 66. Version history →

Why this score
Every page starts at65
Incidents it suffered (e.g. hacks)-6.4
Accepted community evidence-1.4
Sum57
  • 3 sections set aside: the claims did not hold up in a fact-check, pending correction.

Score: 66/100 (kept between 0 and 100)

How scoring works →

Page reliability: Fact-checked 2026-11-02 · 2 of 10 claims confirmed · 4 need better sources · 4 disputed

anchored·4oeNVd…mYGr

Summary

CoinEx is a centralized cryptocurrency exchange that suffered a major hot wallet breach on September 12, 2023, with losses estimated between $54 million and $70 million across multiple blockchains. On-chain investigators ZachXBT and Elliptic attributed the attack to the Lazarus Group (TraderTraitor), a North Korean state-sponsored threat actor, based on wallet address overlap with the contemporaneous Stake.com hack. Stolen proceeds were subsequently laundered in part through the Sinbad Bitcoin mixer, which was sanctioned by the U.S. Treasury's OFAC on November 29, 2023.

Connected Entities

10 entities · 60 linked investigations
Organizations
□TraderTraitor / UNC48990□AlphaPo65□Ethereum90□THORChain□Binance□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□ZachXBT
Protocols
⌂Axie Infinity
Tokens
♦Bitcoin♦CoinEx
Relationships
  • Ethereum→mentioned with→Bitcoin(60%)
  • TraderTraitor / UNC4899→mentioned with→THORChain(70%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
  • ZachXBT→mentioned with→Bitcoin(65%)
  • TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
  • ZachXBT→mentioned with→Binance(60%)
  • Axie Infinity→mentioned with→Binance(70%)
  • Binance→mentioned with→Ethereum(65%)
  • Axie Infinity→mentioned with→Ethereum(80%)
  • + 25 more

Connected Through

10 shared actors · 586 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about CoinEx?
6
Accepted
3
Under review
3
Rejected / revoked

Community submissions

3 submissions awaiting moderator review.

Timeline(6 events)

12 September 2023

CoinEx hot wallets breached at approximately 21:20 UTC+8; private keys compromised; anomalous outflows detected across Ethereum, TRON, BNB Chain, Bitcoin, and other networks. Deposits and withdrawals suspended globally.

13 September 2023

ZachXBT publicly identifies wallet address overlap between CoinEx hacker and Stake.com hacker (attributed to Lazarus Group), suggesting North Korean origin. Elliptic corroborates, noting funds routed through Lazarus-linked bridge infrastructure. Estimated losses revised upward to $54 million after second batch of affected addresses identified.

13 September 2023

CoinEx pledges 100% compensation to all affected users; states cold wallets were not targeted and remaining assets have been secured.

15 September 2023

The Record and other outlets publish detailed attribution reports linking CoinEx breach to North Korea's Lazarus Group based on Elliptic and ZachXBT blockchain forensics.

21 September 2023

CoinEx begins phased resumption of deposit and withdrawal services for select assets after security infrastructure overhaul.

29 November 2023

U.S. Treasury OFAC sanctions Sinbad.io Bitcoin mixer, explicitly citing its use in laundering funds stolen from CoinEx and other Lazarus Group hacks. FBI and Dutch and Finnish law enforcement seize the Sinbad.io domain.

Provenance & Audit Trail

Decision Log

  • #14acceptRecorded on Solana ✓11/3/2026, 11:15:54 PM
    slot 465080199 · hash WGR3XGJuGjDpfr65ZYUuC4y2VmSh6cVn5FaoJcgpTd4
  • #13rejectRecorded on Solana ✓11/3/2026, 11:14:53 PM
    slot 465079853 · hash WVTwN3wJDAnJSHfSrLgQp6zC7tj1pPNawsvZerWXX5E
  • #12accept-1Recorded on Solana ✓11/3/2026, 11:14:50 PM
    slot 465079836 · hash 99J1XXCPMTuPDb6JCkyrwy8hm4SrENdGacczcDCwXFPp
  • #11acceptRecorded on Solana ✓11/3/2026, 11:14:22 PM
    slot 465079645 · hash 6DNjJZGFQvFd4zdqCPkBPVkoro2EA8Kq9JUrPxLitELc
  • #10rejectRecorded on Solana ✓11/3/2026, 11:07:37 PM
    slot 465077823 · hash 6RqpYhLiwV5FgwpEGz8vNyfTXEooN9L6ei6WPzE652qF
  • #9acceptRecorded on Solana ✓11/3/2026, 11:07:29 PM
    slot 465077640 · hash 6a2Ca1UZvKA7gspfb6g8FFJKRK72p91c1t2DNJwr68SK
  • #8accept-1Recorded on Solana ✓11/3/2026, 10:42:19 PM
    slot 465070649 · hash EACb48AZVYP9Vfm9fw6WnUxnWhjJ46um4oxVAN1NPPaa
  • #7rescore+8Recorded on Solana ✓11/2/2026, 4:49:21 AM
    slot 464366784 · hash J7eU3EawwkEV7DA3wcc6XXx9v7t19zxspWLQ444GjQjj
  • #6review denyRecorded on Solana ✓11/2/2026, 4:49:20 AM
    slot 464366779 · hash 8dpsmU7fE4sUYRfrSt5Jrj5gf7DxTaZ8DLo6xe1imteS
  • #5reviewRecorded on Solana ✓11/2/2026, 4:49:20 AM
    slot 464366774 · hash 6dV6djXNMQp82BN4VPDCznmXE8tkhtFErKjd6K66BBhG
  • #4accept-1Recorded on Solana ✓10/30/2026, 3:44:04 AM
    slot 463137908 · hash 6WSdimQGLZBEtWUJ8WpfVYrk24ijU6BMyUXDmCFRfd3S
  • #3rejectRecorded on Solana ✓10/17/2026, 4:59:02 AM
    slot 457912258 · hash Gag8bjewJgqPWFkRirHdp3jN5xHKsjc3YamwcGmhFRcg
  • #2rescore+29Recorded on Solana ✓10/10/2026, 6:47:35 PM
    slot 455367473 · hash 4TvJfPuaeT5v8GPNPdtdweUzygUHEsCYKFVDG9EE5KrT
  • #1publishRecorded on Solana ✓5/19/2026, 3:10:54 AM
    slot 420685924 · hash GG59QEVohZaN8oRzkP4LYTFCAVjsY72k5Wvcr4xncmtm

This investigation is cryptographically anchored to the Solana blockchain (14 decisions). 21 of 23 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-11-0210 claims checked4 corrections pending0 applied⛓ anchoredSee findings →

model: claude-sonnet

generated: 5/4/2026, 2:54:10 AM

last updated: 11/3/2026, 11:15:54 PM

4 views

avoid.net — verified advice for a post-truth world