Skip to main content
AVOID.NET
Sign in

Phemex

avoid.net/phemex→10/100·100% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·LDBroZ…yNWW

Summary

Phemex is a centralized cryptocurrency derivatives exchange founded in November 2019 by former Morgan Stanley executives and registered in the British Virgin Islands. In January 2025, the exchange suffered one of the largest crypto hacks of that year, with an estimated $69–85 million drained from hot wallets across 16 blockchains, subsequently attributed to North Korea's Lazarus Group through on-chain evidence linking the same wallets to the February 2025 Bybit hack. Phemex has also faced formal regulatory enforcement actions in Ontario, Canada, and operates without authorization in the United Kingdom.

Connected Entities

15 entities · 60 linked investigations
Organizations
□Polygon54□Ethereum□THORChain□Phemex□Arbitrum□Ronin Network□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□Cardano□Wintermute□Solana□ZachXBT□Optimism
Tokens
♦Dogecoin♦Bitcoin♦Litecoin
Relationships
  • Wintermute→mentioned with→ZachXBT(60%)
  • Wintermute→mentioned with→Ethereum(70%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • Litecoin→mentioned with→Bitcoin(70%)
  • Optimism→mentioned with→Arbitrum(65%)
  • Optimism→mentioned with→Wintermute(70%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • Optimism→mentioned with→Ethereum(80%)
  • Litecoin→mentioned with→ZachXBT(70%)
  • ZachXBT→mentioned with→Bitcoin(65%)
  • + 43 more
Also appears in
Polygon·54StableMagnet·2Shibarium·28JUDAO·18Shibarium Bridge·32Andean Medjedovic·2Ionic Money·14Allo Protocol·57AnubisDAO·2SushiSwap RouteProcessor Exploit·54+ 50 more

Connected Through

15 shared actors · 552 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Phemex?
0
Accepted
2
Under review
0
Rejected / revoked

Community submissions

Timeline(10 events)

November 2019

Phemex founded by Jack Tao and seven other former Morgan Stanley executives; incorporated in the British Virgin Islands.

2021

UK Financial Conduct Authority designates Phemex as an unauthorized firm operating without FCA approval.

7 January 2023

Phemex implements IP-based blocks on Ontario users after being contacted by the Ontario Securities Commission.

18 December 2024

Ontario Capital Markets Tribunal rules in Phemex Limited (Re), 2024 ONCMT 30 that Phemex operated an unregistered securities trading platform in Ontario; both entities permanently banned from Ontario capital markets.

23 January 2025

Phemex hot wallets drained across 16 blockchains; estimated $69–85 million stolen. Withdrawals suspended at 15:13 UTC. PeckShield and Cyvers flag approximately 125 suspicious transactions.

24 January 2025

Phemex CEO publishes Proof of Reserves and issues compensation plan. Security firms Halborn, Merkle Science, and Hacken begin on-chain analysis; Lazarus Group suspected.

February 2025

Phemex restores full withdrawal services approximately 10 days after the breach.

19 February 2025

Global Ledger identifies 2,080+ ETH from Phemex hack routed through Tornado Cash, eXch mixer, THORChain, and Wintermute.

21 February 2025

Bybit suffers $1.4 billion hack, subsequently attributed to Lazarus Group.

22 February 2025

ZachXBT publicly identifies on-chain commingling of Phemex and Bybit hack proceeds at Ethereum address 0x33d057af74779925c4b2e720a820387cb89f8f65, directly linking both hacks to Lazarus Group.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain11 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 11 of 17 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:26 AM

last updated: 9/16/2026, 12:39:58 AM

5 views

avoid.net — verified advice for a post-truth world