Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #2[disputed][awaiting moderator]in section: Sinbad Mixer: Post-Hack Laundering

   “OFAC's press release documented Sinbad's use in laundering proceeds from the Stake.com, CoinEx, FTX, and Axie Infinity hacks, among others.”

   reviewerOFAC press release documented Sinbad laundering of Stake.com, CoinEx, FTX proceedsThe attribution to OFAC's press release is wrong. The CoinEx link comes from Elliptic. The fetch was a summarised view of the Treasury page, so confidence is moderate.
   Proposed correction (not yet applied)

   Elliptic's analysis of the OFAC action documented Sinbad's use in laundering proceeds from the Stake.com, CoinEx, FTX, and Axie Infinity hacks, among others.
   citedhome.treasury.gov/news/press-releases/jy1933
2. #3[disputed][awaiting moderator]in section: Sinbad Mixer: Post-Hack Laundering

   “citing its role as 'a key money-laundering tool for the Lazarus Group.'”

   reviewerTreasury release states Sinbad as 'a key money-laundering tool for the Lazarus Group'The quotation is slightly misquoted. The meaning is the same.
   Proposed correction (not yet applied)

   citing its role as 'a key money-laundering tool of the OFAC-designated Lazarus Group.'
   citedhome.treasury.gov/news/press-releases/jy1933
3. #4[disputed][awaiting moderator]in section: Sinbad Mixer: Post-Hack Laundering

   “The sanctioning of Sinbad represents a Tier 1 regulatory confirmation that the CoinEx hack proceeds were laundered through a DPRK-linked infrastructure.”

   reviewerThe Sinbad sanction is Tier 1 regulatory confirmation that CoinEx proceeds were laundered via SinbadOverstated. The CoinEx link comes from private-sector analysis, not from the regulator.
   Proposed correction (not yet applied)

   The sanctioning of Sinbad, together with Elliptic's analysis, indicates that part of the CoinEx hack proceeds were laundered through a DPRK-linked service.
   citedhome.treasury.gov/news/press-releases/jy1933
4. #5[disputed][awaiting moderator]in the timeline

   “U.S. Treasury OFAC sanctions Sinbad.io Bitcoin mixer, explicitly citing its use in laundering funds stolen from CoinEx and other Lazarus Group hacks.”

   reviewerOFAC explicitly cited use in laundering CoinEx fundsThe cited Treasury source does not name CoinEx.
   Proposed correction (not yet applied)

   U.S. Treasury OFAC sanctions Sinbad.io Bitcoin mixer, citing its use in laundering funds stolen by the Lazarus Group; Elliptic reports that Sinbad was used to launder proceeds of the CoinEx hack.
   citedhome.treasury.gov/news/press-releases/jy1933

No source the reviewer could reach confirms or contradicts the claim.

1. #6[unverifiable][awaiting moderator]in section: Sinbad Mixer: Post-Hack Laundering

   “The same enforcement action resulted in the FBI and Dutch and Finnish law enforcement authorities seizing the Sinbad.io website.”

   reviewerFBI and Dutch and Finnish law enforcement seized Sinbad.ioThe seizure itself is reported in the cited headlines. The agency list was not verified.
   citedhome.treasury.gov/news/press-releases/jy1933
2. #7[unverifiable][awaiting moderator]in section: The September 2023 Hot Wallet Breach

   “CoinEx itself later acknowledged a figure closer to $70 million in its post-incident communications.”

   reviewerTotal loss estimates and CoinEx's figure of about $70 millionThe official CoinEx post could not be read. The $54M interim figure was confirmed by CoinDesk (initial estimate about $27M, later $54M).
   citedcoinex.medium.com/coinex-updates-on-rece…ack-780a600dc846
3. #8[unverifiable][awaiting moderator]in section: The September 2023 Hot Wallet Breach

   “On September 12, 2023 at approximately 21:20 UTC+8, CoinEx's internal risk-control systems detected anomalous outflows from multiple hot wallets used for temporary storage of user assets.”

   reviewerHack date, sub-claims on suspension, 211 networks and 737 assetsThe CoinEx primary source was blocked. The date is consistent with CoinDesk and the other cited coverage.
   citedcoinex.medium.com/coinex-updates-on-rece…ack-780a600dc846
4. #9[unverifiable][awaiting moderator]in section: Exchange Response, Compensation, and Service Restoration

   “According to post-incident reporting, CoinEx ultimately absorbed the full $70 million loss and restored normal operations within approximately nine months without diluting the supply of its native CET token.”

   reviewerPhased restoration of services and the 9-month rebuild without diluting CETI did not fetch this low-tier source. The statement is hedged as 'post-incident reporting'. It is also stale in context, because CoinEx announced a wind-down in September 2026.
   citedwww.cryptonewsnavigator.com/academy/arti…uilt-in-9-months

The cited evidence supports part of the claim but not all of it.

1. #1[partially supported][awaiting moderator]in section: North Korea TraderTraitor (Lazarus Group) Attribution

   “ZachXBT identified that stolen CoinEx funds had been routed to an Ethereum address (0x75497999432b8701330fb68058bd21918c02ac59) that had also received funds from the contemporaneous Stake.com hack”

   reviewerZachXBT linked CoinEx hack funds to an address that also received Stake.com hack fundsAddress and the Stake link are confirmed. The 'Ethereum address' characterisation is not clearly supported by the CoinDesk article. The page's Elliptic corroboration was not checked against the cited Elliptic blog.
   citedwww.coindesk.com/tech/2023/09/13/north-k…in-data-suggests

The cited evidence supports the claim as written.

1. #10[confirmed][no action needed]in section: North Korea TraderTraitor (Lazarus Group) Attribution

   “The FBI had previously attributed the Stake.com hack to North Korea's TraderTraitor group in September 2023”

   reviewerElliptic corroborated and Lazarus attribution; FBI attributions of Stake.comConsistent with the cited coverage and with my background knowledge of the FBI statement.
   citedwww.coindesk.com/tech/2023/09/13/north-k…in-data-suggests