Verify a decision

{"actor":"system:backfill","investigation_id":"57fe7602-1a16-49d9-ae77-f6adf0837007","kind":"publish","page_slug":"lcx-exchange","published_at":"2026-06-01T17:48:20.242Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"LCX Exchange","sections":[{"content":"On January 8, 2022, between 11:23 PM and 11:37 PM CET, an unauthorized actor accessed LCX's Ethereum hot wallets and drained multiple token balances. According to LCX's own incident report, the stolen assets included approximately 162.68 ETH (~$502,671), 3,437,783 USDC (~$3.44 million), 761,236 EURe (~$864,840), 17,251,192 LCX tokens (~$2.47 million), 101,249 SAND (~$485,995), 1,847 LINK (~$48,557), 669 QNT (~$115,609), 4,819 ENJ (~$10,890), and 4.76 MKR (~$9,885), for a reported total of approximately $7.94 million. An additional 611,000 EURe was separately frozen. The exchange paused all deposits and withdrawals immediately upon detection. TRM Labs, which analyzed the fund flows, noted the attacker converted all stolen assets to ETH via DeFi protocols within 45 minutes and deposited the proceeds into Tornado Cash mixing contracts by approximately 11:12 PM GMT — an unusually rapid and operationally disciplined laundering sequence.","heading":"January 2022 Hot Wallet Hack","severity":"critical","sources":[{"credibility":1,"name":"Hot Wallet Incident Report — LCX (Official)","type":"official","url":"https://www.lcx.com/hot-wallet-incident-report/"},{"credibility":2,"name":"Exploit Radar: LCX Hot Wallet Hack — TRM Labs","type":"news","url":"https://www.trmlabs.com/post/exploit-radar-lcx-hot-wallet-hack"}]},{"content":"Some secondary sources and community reports have alleged that the LCX hack bears hallmarks consistent with North Korea's Lazarus Group (also known as APT38), citing the speed of the laundering operation, the use of Tornado Cash mixing contracts, and fund-flow patterns similar to other attributed Lazarus incidents. However, as of the time of writing, no Tier 1 source — including the FBI, DOJ, OFAC, TRM Labs, Elliptic, or Chainalysis — has published a formal public attribution linking the LCX January 2022 hack to Lazarus Group. LCX's own published materials and TRM Labs' exploit analysis refer to the attackers only as unknown or unidentified. This attribution claim should therefore be treated as low-confidence and unverified until a credible forensic firm or law enforcement agency issues a formal public statement.","heading":"Alleged Attribution to Lazarus Group","severity":"high","sources":[{"credibility":1,"name":"LCX Hack Update — LCX (Official, no attribution claimed)","type":"official","url":"https://www.lcx.com/lcx-hack-update/"},{"credibility":2,"name":"Exploit Radar: LCX Hot Wallet Hack — TRM Labs (no attribution to Lazarus)","type":"research","url":"https://www.trmlabs.com/post/exploit-radar-lcx-hot-wallet-hack"},{"credibility":2,"name":"How the Lazarus Group is stepping up crypto hacks — Elliptic (general Lazarus context, LCX not cited)","type":"research","url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics"}]},{"content":"Following the hack, LCX engaged law enforcement agencies in Liechtenstein, Ireland, Spain, and the United States. Through cooperation with Irish and Liechtenstein police and public prosecutors, a Liechtenstein court order was obtained that resulted in the freezing of 500 ETH at Coinbase Europe. Separately, LCX's legal team — represented by Holland & Knight and Bluestone — filed a complaint on June 1, 2022, in the New York Supreme Court. On June 2, 2022, the court issued a temporary restraining order and, in a legally notable first, authorized service of process via an ERC-721 NFT airdropped directly to the hacker's Ethereum wallet address. The New York Supreme Court subsequently ordered the blacklisting of the hacker's wallet, resulting in the on-chain freeze of 1,274,249 USDC by the Centre Consortium (co-founded by Circle and Coinbase). By LCX's own account, approximately 60% of stolen funds had been frozen as of June 2022. LCX stated it covered all remaining user losses from company funds, with no impact on user balances.","heading":"Fund Recovery and Law Enforcement Cooperation","severity":"medium","sources":[{"credibility":1,"name":"LCX Hack Update — LCX (Official)","type":"official","url":"https://www.lcx.com/lcx-hack-update/"},{"credibility":2,"name":"Anonymous hacker served with restraining order via NFT — CoinTelegraph","type":"news","url":"https://cointelegraph.com/news/anonymous-hacker-served-with-restraining-order-via-nft"},{"credibility":2,"name":"New York Supreme Court: Approves Court Notice Served Via NFT — LCX AG v John Does 1-2 — Lexology","type":"other","url":"https://www.lexology.com/library/detail.aspx?g=8244ba2b-db9b-43a5-be60-084cb3aa4871"},{"credibility":1,"name":"LCX AG v Doe — Amended Complaint (Holland & Knight via NYSCEF)","type":"court_filing","url":"https://www.hklaw.com/-/media/files/generalpages/lcx-ag-v-doe/nyscef22amcompl.pdf"}]},{"content":"LCX has been registered as a Crypto Assets Service Provider (CASP) in Liechtenstein since 2020 under the country's Blockchain Act (Trusted Technology Service Provider Act, TVTG), regulated by the Financial Market Authority (FMA). According to CoinDesk reporting from January 2021, LCX obtained 8 of the 11 available crypto-related license categories in Liechtenstein, covering exchange operations, digital asset custody, price oracle provision, KYC/AML compliance services, smart contract generation, and token issuance. In December 2024, LCX filed a pre-application for a pan-European MiCA (Markets in Crypto Assets Regulation) license with the Liechtenstein FMA; formal applications became eligible upon MiCA's applicability in the EEA on February 1, 2025. A full MiCA license would grant passporting rights across 30 EEA member states. No regulatory sanctions, enforcement actions, or license revocations have been identified in public records.","heading":"Regulatory Status and Licensing","severity":"low","sources":[{"credibility":2,"name":"LCX Exchange Gets Licensed in Liechtenstein — CoinDesk","type":"news","url":"https://www.coindesk.com/business/2021/01/05/lcx-exchange-gets-licensed-in-liechtenstein-to-help-banks-create-their-own-digital-assets"},{"credibility":1,"name":"Crypto Exchange LCX Files Pre-Application For MiCA License in Liechtenstein — GlobeNewswire","type":"official","url":"https://www.globenewswire.com/news-release/2024/12/24/3001715/0/en/Crypto-Exchange-LCX-Files-Pre-Application-For-MiCA-License-in-Liechtenstein.html"},{"credibility":2,"name":"LCX Exchange Secures 8 of 11 Crypto Licenses in Liechtenstein — Chain Bulletin","type":"news","url":"https://chainbulletin.com/lcx-exchange-secures-8-of-11-crypto-licenses-in-liechtenstein"}]},{"content":"LCX's hot wallet compromise involved the theft of private keys or access credentials, though the exact attack vector was not disclosed in public filings. The exchange resumed deposits and withdrawals on January 28, 2022, approximately 20 days after the incident. LCX stated it implemented heightened security infrastructure following the breach and engaged Elliptic as its compliance partner to flag hacker wallets on-chain. The exchange collaborated with TRM Labs and Etherscan to mark and trace stolen funds. The speed with which attackers converted and laundered funds — all stolen assets moved through Tornado Cash within 45 minutes of initial access — indicates a high degree of operational sophistication on the part of the attacker, which security researchers have noted is consistent (though not exclusively so) with advanced persistent threat (APT) actor profiles.","heading":"Operational Security and Post-Incident Posture","severity":"high","sources":[{"credibility":1,"name":"Hot Wallet Incident Report — LCX (Official)","type":"official","url":"https://www.lcx.com/hot-wallet-incident-report/"},{"credibility":2,"name":"Exploit Radar: LCX Hot Wallet Hack — TRM Labs","type":"research","url":"https://www.trmlabs.com/post/exploit-radar-lcx-hot-wallet-hack"}]},{"content":"As of 2025–2026, LCX continues to operate as a regulated crypto exchange in Liechtenstein. The exchange launched a 'Buy Crypto' feature in January 2026 and in February 2026 announced Liberty Chain, a Layer 2 blockchain described as targeting institutional tokenization and regulated trading. The LCX utility token has been classified under MiCA's utility token category, with defined use cases including fee discounts and tokenization services. The exchange has not been subject to any publicly identified regulatory enforcement actions, fraud allegations, or additional security incidents since the January 2022 hack.","heading":"Current Operations and Developments (2024–2026)","severity":"low","sources":[{"credibility":3,"name":"LCX: The Compliance Web3 Trading Platform of 2025 — Gate Blog","type":"news","url":"https://www.gate.com/blog/LCX-Crypto--The-Regulated-Web3-Trading-Platform-in-2025"},{"credibility":3,"name":"LCX Crypto — Liechtenstein's Regulated Exchange Leads Web3 — Blockchain Magazine","type":"news","url":"https://www.blockchainmagazine.net/lcx-crypto-liechtenstein-regulated-exchange/"}]}],"sources_used":[{"name":"Hot Wallet Incident Report — LCX","type":"official","url":"https://www.lcx.com/hot-wallet-incident-report/"},{"name":"LCX Hack Update — LCX","type":"official","url":"https://www.lcx.com/lcx-hack-update/"},{"name":"Exploit Radar: LCX Hot Wallet Hack — TRM Labs","type":"research","url":"https://www.trmlabs.com/post/exploit-radar-lcx-hot-wallet-hack"},{"name":"LCX Exchange Gets Licensed in Liechtenstein — CoinDesk","type":"news","url":"https://www.coindesk.com/business/2021/01/05/lcx-exchange-gets-licensed-in-liechtenstein-to-help-banks-create-their-own-digital-assets"},{"name":"Anonymous hacker served with restraining order via NFT — CoinTelegraph","type":"news","url":"https://cointelegraph.com/news/anonymous-hacker-served-with-restraining-order-via-nft"},{"name":"LCX AG v Doe — Amended Complaint (Holland & Knight via NYSCEF)","type":"court_filing","url":"https://www.hklaw.com/-/media/files/generalpages/lcx-ag-v-doe/nyscef22amcompl.pdf"},{"name":"New York Supreme Court: Approves Court Notice Served Via NFT — Lexology","type":"other","url":"https://www.lexology.com/library/detail.aspx?g=8244ba2b-db9b-43a5-be60-084cb3aa4871"},{"name":"Crypto Exchange LCX Files Pre-Application For MiCA License — GlobeNewswire","type":"official","url":"https://www.globenewswire.com/news-release/2024/12/24/3001715/0/en/Crypto-Exchange-LCX-Files-Pre-Application-For-MiCA-License-in-Liechtenstein.html"},{"name":"LCX Exchange Secures 8 of 11 Crypto Licenses in Liechtenstein — Chain Bulletin","type":"news","url":"https://chainbulletin.com/lcx-exchange-secures-8-of-11-crypto-licenses-in-liechtenstein"},{"name":"LCX Hack: Analysis of the Fund Flow — Breadcrumbs App (Medium)","type":"research","url":"https://medium.com/breadcrumbsapp/lcx-hack-analysis-of-the-fund-flow-87fe8c5fc5b3"},{"name":"How the Lazarus Group is stepping up crypto hacks — Elliptic","type":"research","url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics"},{"name":"LCX — Regulated Crypto Exchange (Official Website)","type":"official","url":"https://www.lcx.com/"}],"summary":"LCX Exchange (Liechtenstein Cryptoassets Exchange) is a regulated crypto trading platform incorporated in Liechtenstein and registered with the country's Financial Market Authority (FMA). On January 8, 2022, the exchange suffered a hot wallet compromise resulting in the theft of approximately $6.8–7.94 million in various cryptocurrencies; LCX subsequently covered all user losses from company funds and cooperated with multi-jurisdictional law enforcement, ultimately freezing approximately 60% of stolen assets. As of 2024–2025, LCX remains operational, holds multiple licenses under the Liechtenstein Blockchain Act (TVTG), and has filed a pre-application for a pan-European MiCA license.","timeline":[{"date":"2018-04-01","event":"LCX AG (Liechtenstein Cryptoassets Exchange) incorporated in Liechtenstein.","source":"LCX Official / CoinDesk","source_url":"https://www.coindesk.com/business/2021/01/05/lcx-exchange-gets-licensed-in-liechtenstein-to-help-banks-create-their-own-digital-assets"},{"date":"2020-01-01","event":"LCX registered as a Crypto Assets Service Provider (CASP) in Liechtenstein under the Blockchain Act (TVTG).","source":"LCX Official","source_url":"https://www.lcx.com/"},{"date":"2021-01-05","event":"LCX obtains 8 of 11 available crypto license categories under Liechtenstein's Blockchain Act, as reported by CoinDesk.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2021/01/05/lcx-exchange-gets-licensed-in-liechtenstein-to-help-banks-create-their-own-digital-assets"},{"date":"2022-01-08","event":"Hot wallet compromise: unauthorized actor drains approximately $7.94 million in ETH, USDC, EURe, LCX, SAND, LINK, QNT, ENJ, and MKR between 11:23 PM and 11:37 PM CET. All funds moved through Tornado Cash within 45 minutes.","source":"LCX Hot Wallet Incident Report / TRM Labs","source_url":"https://www.lcx.com/hot-wallet-incident-report/"},{"date":"2022-01-09","event":"LCX pauses all deposits and withdrawals; notifies partners Monerium and Liquid Global, Liechtenstein authorities, and blockchain analytics firm Elliptic.","source":"LCX Hot Wallet Incident Report","source_url":"https://www.lcx.com/hot-wallet-incident-report/"},{"date":"2022-01-28","event":"LCX resumes deposits and withdrawals; states all user losses covered from company funds.","source":"LCX Official","source_url":"https://www.lcx.com/lcx-hack-update/"},{"date":"2022-06-01","event":"LCX files complaint in the New York Supreme Court against anonymous defendants (LCX AG v. John Does 1-2).","source":"LCX Hack Update / Holland & Knight NYSCEF filing","source_url":"https://www.hklaw.com/-/media/files/generalpages/lcx-ag-v-doe/nyscef22amcompl.pdf"},{"date":"2022-06-02","event":"New York Supreme Court issues temporary restraining order and authorizes service of legal process via NFT airdrop to hacker's Ethereum wallet — a legal first. Centre Consortium freezes 1,274,249 USDC on-chain per court order.","source":"CoinTelegraph / Lexology","source_url":"https://cointelegraph.com/news/anonymous-hacker-served-with-restraining-order-via-nft"},{"date":"2022-06-07","event":"LCX reports approximately 60% of stolen funds frozen across multiple jurisdictions, including 500 ETH frozen at Coinbase Europe via Liechtenstein court order.","source":"LCX Hack Update","source_url":"https://www.lcx.com/lcx-hack-update/"},{"date":"2024-12-24","event":"LCX files pre-application for pan-European MiCA license with Liechtenstein's Financial Market Authority (FMA).","source":"GlobeNewswire","source_url":"https://www.globenewswire.com/news-release/2024/12/24/3001715/0/en/Crypto-Exchange-LCX-Files-Pre-Application-For-MiCA-License-in-Liechtenstein.html"},{"date":"2026-02-01","event":"LCX announces Liberty Chain, a Layer 2 blockchain targeting institutional tokenization.","source":"Gate Blog / Blockchain Magazine","source_url":"https://www.gate.com/blog/LCX-Crypto--The-Regulated-Web3-Trading-Platform-in-2025"}]},"v":1}