Summary
DEXX is a Solana-based on-chain memecoin trading terminal that suffered a catastrophic private key compromise on November 16, 2024, resulting in approximately $30 million in user losses across more than 8,600 wallets. Despite marketing itself as non-custodial, DEXX stored user private keys in plaintext on its own servers — a centralization risk that CertiK had flagged as unresolved prior to the breach. A partial compensation initiative led by LBank was announced in early 2025, but full recovery of stolen funds remains unlikely as the attacker laundered substantial ETH through Tornado Cash.
Connected Entities
1 entitiesTimeline(14 events)
2024-11-16
DEXX private key breach begins; user assets across 8,600+ Solana wallets start draining in early morning hours
2024-11-16
CertiK confirms breach on Solana blockchain, attributes cause to improper private key management by DEXX platform
2024-11-16
DEXX founder Roy publicly acknowledges incident, asks for time to address the issue
2024-11-16
GoPlus Security warns DEXX victims of secondary phishing scams soliciting private key uploads
2024-11-17
DEXX applies for judicial wallet marking and requests Solana Foundation assistance to freeze hacker addresses
2024-11-28
SlowMist publishes investigation linking 8,612 Solana wallet addresses to attacker; total losses revised to $30 million
2024-12-02
SlowMist reveals EVM chain victim and attacker addresses, expanding scope to 7,205 EVM wallets
2024-12-09
Attacker begins depositing stolen ETH into Tornado Cash; initial transfers of approximately 1,000 ETH reported
2024-12-09
DEXX hacker transfers 4,700 ETH to Tornado Cash in a single batch
2024-12-10
Additional 300 ETH batch transferred to Tornado Cash by DEXX attacker; SlowMist founder Cosine confirms
2024-12-14
DEXX launches formal compensation portal for affected users
2025-02-05
DEXX opens compensation NFT staking portal, allowing affected users to participate in repayment scheme
2025-02-08
LBank announces $15 million seven-party coalition donation initiative for DEXX user compensation
2025-02-18
LBank reports more than 3,000 addresses have received compensation payments; compensation process at approximately 30% completion
Decision Log
- hash: 93rbMMY91QXubbt99MmQT1PKmwbz4Q1bmceBS8TsKxLP
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-5
generated: 5/4/2026, 2:54:27 AM
last updated: 5/20/2026, 3:37:15 AM
avoid.net — verified advice for a post-truth world