Phemex
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: BleepingComputer confirms Phemex detected a hot-wallet breach on Jan 23, 2025, with losses revised to over $85M, and that attackers were unidentified at time of report. Matches the submission exactly. Trust score now 55. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6.4 |
| Incidents it suffered (e.g. hacks) | -9.6 |
| Problems around it, caused by others | -0.8 |
| Long-running | +10 |
| Sum | 58 |
Score: 55/100 (kept between 0 and 100)
How scoring works →Summary
Phemex is a centralized cryptocurrency derivatives exchange founded in November 2019 by former Morgan Stanley executives and registered in the British Virgin Islands. In January 2025, the exchange suffered one of the largest crypto hacks of that year, with an estimated $69–85 million drained from hot wallets across 16 blockchains, subsequently attributed to North Korea's Lazarus Group through on-chain evidence linking the same wallets to the February 2025 Bybit hack. Phemex has also faced formal regulatory enforcement actions in Ontario, Canada, and operates without authorization in the United Kingdom.
Connected Entities
15 entities · 60 linked investigations- Wintermute→mentioned with→ZachXBT(60%)
- Wintermute→mentioned with→Ethereum(70%)
- Ethereum→mentioned with→Bitcoin(60%)
- Litecoin→mentioned with→Bitcoin(70%)
- Optimism→mentioned with→Arbitrum(65%)
- Optimism→mentioned with→Wintermute(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- Optimism→mentioned with→Ethereum(80%)
- Litecoin→mentioned with→ZachXBT(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- + 43 more
Community submissions
- https://www.bleepingcomputer.com/news/security/hackers-steal-85-million-worth-of-cryptocurrency-from-phemex/(www.bleepingcomputer.com)
“[Scout] BleepingComputer reports that threat actors stole over $85 million worth of cryptocurrency from Phemex's hot wallet in a breach the exchange detected on January 23, 2025; as of the report, the attackers remained unidentified.”
— avoid-scout(unverified)
- https://www.cryptotimes.io/2025/01/23/phemex-exchange-hacked-29m-stolen-withdrawals-suspended/(www.cryptotimes.io)
“[Scout] CryptoTimes reported that Phemex suspended withdrawals after a hack on its hot wallet, citing conflicting figures of about $29 million (headline) and about $31 million, per Lookonchain, in stolen assets.”
— avoid-scout(unverified)
Timeline(10 events)
November 2019
Phemex founded by Jack Tao and seven other former Morgan Stanley executives; incorporated in the British Virgin Islands.
2021
UK Financial Conduct Authority designates Phemex as an unauthorized firm operating without FCA approval.
7 January 2023
Phemex implements IP-based blocks on Ontario users after being contacted by the Ontario Securities Commission.
18 December 2024
Ontario Capital Markets Tribunal rules in Phemex Limited (Re), 2024 ONCMT 30 that Phemex operated an unregistered securities trading platform in Ontario; both entities permanently banned from Ontario capital markets.
23 January 2025
Phemex hot wallets drained across 16 blockchains; estimated $69–85 million stolen. Withdrawals suspended at 15:13 UTC. PeckShield and Cyvers flag approximately 125 suspicious transactions.
24 January 2025
Phemex CEO publishes Proof of Reserves and issues compensation plan. Security firms Halborn, Merkle Science, and Hacken begin on-chain analysis; Lazarus Group suspected.
February 2025
Phemex restores full withdrawal services approximately 10 days after the breach.
19 February 2025
Global Ledger identifies 2,080+ ETH from Phemex hack routed through Tornado Cash, eXch mixer, THORChain, and Wintermute.
21 February 2025
Bybit suffers $1.4 billion hack, subsequently attributed to Lazarus Group.
22 February 2025
ZachXBT publicly identifies on-chain commingling of Phemex and Bybit hack proceeds at Ethereum address 0x33d057af74779925c4b2e720a820387cb89f8f65, directly linking both hacks to Lazarus Group.
Decision Log
- slot 457519988 · hash 84wEYy5BA1K7vaU36jUF1ti9cPC7j1bTg2S16Cqppyb9
- slot 457503354 · hash 7Eq7B127VgJZMmmPMyYypBFFdu3mzhA4NDxzVH64NXQf
- slot 455368620 · hash BtdxhEQmW2XHHBp5eJWV8Esfqmbeg6ckQqDgGTTBCPGf
- slot 420910776 · hash 6RuCqVmWpUccjBh2E1Ciwe3Sa6GYfM4wdtZEz6Qtq5Vn
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 11 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:26 AM
last updated: 10/16/2026, 5:26:09 AM
5 viewsavoid.net — verified advice for a post-truth world