Skip to main content
AVOID.NET
Sign in

CoinEx

avoid.net/coinex→32/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama][src:slowmist][src:zachxbt][apt38][cefi][certik][compensation][cross-chain][dprk][elliptic][exchange][hack][hot-wallet][lazarus][mixer][multi-chain][north-korea][ofac-sanctioned][private-key-compromise][sinbad][tradertraitor]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·4oeNVd…mYGr

Summary

CoinEx is a centralized cryptocurrency exchange that suffered a major hot wallet breach on September 12, 2023, with losses estimated between $54 million and $70 million across multiple blockchains. On-chain investigators ZachXBT and Elliptic attributed the attack to the Lazarus Group (TraderTraitor), a North Korean state-sponsored threat actor, based on wallet address overlap with the contemporaneous Stake.com hack. Stolen proceeds were subsequently laundered in part through the Sinbad Bitcoin mixer, which was sanctioned by the U.S. Treasury's OFAC on November 29, 2023.

Connected Entities

10 entities · 60 linked investigations
Organizations
□TraderTraitor / UNC48990□AlphaPo10□Ethereum64□THORChain□Binance□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□ZachXBT
Protocols
⌂Axie Infinity
Tokens
♦Bitcoin♦CoinEx
Relationships
  • Ethereum→mentioned with→Bitcoin(60%)
  • TraderTraitor / UNC4899→mentioned with→THORChain(70%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
  • ZachXBT→mentioned with→Bitcoin(65%)
  • TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
  • ZachXBT→mentioned with→Binance(60%)
  • Axie Infinity→mentioned with→Binance(70%)
  • Binance→mentioned with→Ethereum(65%)
  • Axie Infinity→mentioned with→Ethereum(80%)
  • + 25 more
Also appears in
Q2 2026 DeFi Record Hack Wave·0Coldcard Firmware Exploit (2026)·10Crossmint·70TraderTraitor / UNC4899·0Harmony Horizon Bridge·4ALEX Lab·24Nobitex June 2025 Hack (Predatory Sparrow)·10WOO X·38KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus·0Compounder Finance·2+ 50 more
Have evidence about CoinEx?
0
Accepted
4
Under review
0
Rejected / revoked

Community submissions

Timeline(6 events)

12 September 2023

CoinEx hot wallets breached at approximately 21:20 UTC+8; private keys compromised; anomalous outflows detected across Ethereum, TRON, BNB Chain, Bitcoin, and other networks. Deposits and withdrawals suspended globally.

13 September 2023

ZachXBT publicly identifies wallet address overlap between CoinEx hacker and Stake.com hacker (attributed to Lazarus Group), suggesting North Korean origin. Elliptic corroborates, noting funds routed through Lazarus-linked bridge infrastructure. Estimated losses revised upward to $54 million after second batch of affected addresses identified.

13 September 2023

CoinEx pledges 100% compensation to all affected users; states cold wallets were not targeted and remaining assets have been secured.

15 September 2023

The Record and other outlets publish detailed attribution reports linking CoinEx breach to North Korea's Lazarus Group based on Elliptic and ZachXBT blockchain forensics.

21 September 2023

CoinEx begins phased resumption of deposit and withdrawal services for select assets after security infrastructure overhaul.

29 November 2023

U.S. Treasury OFAC sanctions Sinbad.io Bitcoin mixer, explicitly citing its use in laundering funds stolen from CoinEx and other Lazarus Group hacks. FBI and Dutch and Finnish law enforcement seize the Sinbad.io domain.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain21 Wayback Archivessrc:defillamasrc:slowmistsrc:zachxbt

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 21 of 23 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet

generated: 5/4/2026, 2:54:10 AM

last updated: 8/30/2026, 8:07:18 PM

4 views

avoid.net — verified advice for a post-truth world