Verify a decision

{"actor":"system:backfill","investigation_id":"d92e1f6b-7eff-4736-87ca-242d88651e2e","kind":"publish","page_slug":"coinex","published_at":"2026-05-19T03:10:54.547Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"CoinEx","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":1,"name":"CoinEx Medium: Updates on Recent Hot Wallets Hack","type":"official","url":"https://coinex.medium.com/coinex-updates-on-recent-hot-wallets-hack-780a600dc846"},{"credibility":2,"name":"BleepingComputer: Hackers steal $53 million worth of cryptocurrency from CoinEx","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/hackers-steal-53-million-worth-of-cryptocurrency-from-coinex/"},{"credibility":2,"name":"The Crypto Basic: $54M In XRP, Bitcoin, Ethereum Stolen from CoinEx","type":"news_article","url":"https://thecryptobasic.com/2023/09/13/54m-in-xrp-bitcoin-ethereum-stolen-from-coinex-in-recent-hack/"},{"credibility":2,"name":"Halborn: Explained: The CoinEx Hack (September 2023)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-coinex-hack-september-2023"},{"credibility":2,"name":"ImmuneBytes: CoinEx Global Exploit – Sep 12, 2023 – Detailed Hack Analysis","type":"research","url":"https://immunebytes.com/blog/coinex-global-exploit-sep-12-2023-detailed-hack-analysis/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":1,"name":"CoinDesk: North Korean Attackers Linked to $54M CoinEx Hack, Blockchain Data Suggests","type":"news_article","url":"https://www.coindesk.com/tech/2023/09/13/north-korean-attackers-linked-to-54m-coinex-hack-blockchain-data-suggests"},{"credibility":2,"name":"Elliptic: How the Lazarus Group is stepping up crypto hacks and changing its tactics","type":"research","url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics"},{"credibility":2,"name":"The Block: North Korean Lazarus Group likely behind CoinEx's $55 million hack — ZachXBT","type":"news_article","url":"https://www.theblock.co/post/250691/north-korean-lazarus-group-likely-behind-coinexs-55-million-hack-zachxbt"},{"credibility":2,"name":"CoinTelegraph: North Korea's Lazarus Group responsible for $55M CoinEx hack: Report","type":"news_article","url":"https://cointelegraph.com/news/coinex-north-korea-s-lazarus-group-responsible-for-55-m-coin-ex-hack-report"},{"credibility":1,"name":"The Record: Evidence points to North Korea in CoinEx cryptocurrency hack","type":"news_article","url":"https://therecord.media/coinex-cryptocurrency-heist-north-korea"},{"credibility":2,"name":"CryptoNews: Elliptic — North Korean Lazarus Group Theft Spree Reaches $240 Million in 104 Days","type":"news_article","url":"https://cryptonews.com/news/elliptic-blockchain-surveillance-firm-north-korean-lazarus-group-theft-spree-reaches-240-million-104-days/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":1,"name":"U.S. Treasury: Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/jy1933"},{"credibility":1,"name":"TechCrunch: Feds seize Sinbad crypto mixer allegedly used by North Korean hackers","type":"news_article","url":"https://techcrunch.com/2023/11/29/feds-seize-sinbad-crypto-mixer-allegedly-used-by-north-korean-hackers/"},{"credibility":2,"name":"Elliptic: Sinbad crypto mixer flagged by Elliptic sanctioned and seized","type":"research","url":"https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized"},{"credibility":2,"name":"Chainalysis: Crypto Mixer Sinbad Sanctioned for North Korean Laundering Activities","type":"research","url":"https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/"},{"credibility":1,"name":"The Record: US Treasury sanctions Sinbad cryptocurrency mixer used by North Korean hackers","type":"news_article","url":"https://therecord.media/us-treasury-sanctions-sinbad-crypto-mixer"},{"credibility":2,"name":"TRM Labs: What We Know About Sinbad — the Mixer Sanctioned by OFAC for its Use by North Korea","type":"research","url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"CCN: CoinEx Suspends Operations After $54M Hack, Promises 100% Compensation","type":"news_article","url":"https://www.ccn.com/news/coinex-suspends-operations-full-compensation/"},{"credibility":2,"name":"BitPinas: CoinEx Assures 100% Compensation Following Recent Attack","type":"news_article","url":"https://bitpinas.com/business/coinex-assures-compensation/"},{"credibility":2,"name":"BeInCrypto: CoinEx Resumes Deposits and Withdrawals After Hack","type":"news_article","url":"https://beincrypto.com/coinex-resumes-deposits-withdrawals/"},{"credibility":2,"name":"Crypto News Navigator: CoinEx Survived a $70M Hack and Rebuilt in 9 Months","type":"news_article","url":"https://www.cryptonewsnavigator.com/academy/article/coinex-survived-a-70m-hack-and-rebuilt-in-9-months"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"Elliptic: How the Lazarus Group is stepping up crypto hacks and changing its tactics","type":"research","url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics"},{"credibility":2,"name":"Risky Business News: Lazarus steals $54 million from CoinEx crypto-exchange","type":"news_article","url":"https://risky.biz/north-korean-hackers-are-behind-coinex-hack/"},{"credibility":2,"name":"CoinMarketCap: $54M CoinEx Hack Linked to North Korean Lazarus Group","type":"news_article","url":"https://coinmarketcap.com/academy/article/dollar54m-coinex-hack-linked-to-north-korean-lazarus-group"},{"credibility":2,"name":"Chainalysis: Crypto Mixer Sinbad Sanctioned for North Korean Laundering Activities","type":"research","url":"https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/"}]}],"sources_used":[],"summary":"CoinEx is a centralized cryptocurrency exchange that suffered a major hot wallet breach on September 12, 2023, with losses estimated between $54 million and $70 million across multiple blockchains. On-chain investigators ZachXBT and Elliptic attributed the attack to the Lazarus Group (TraderTraitor), a North Korean state-sponsored threat actor, based on wallet address overlap with the contemporaneous Stake.com hack. Stolen proceeds were subsequently laundered in part through the Sinbad Bitcoin mixer, which was sanctioned by the U.S. Treasury's OFAC on November 29, 2023.","timeline":[{"date":"2023-09-12","event":"CoinEx hot wallets breached at approximately 21:20 UTC+8; private keys compromised; anomalous outflows detected across Ethereum, TRON, BNB Chain, Bitcoin, and other networks. Deposits and withdrawals suspended globally.","source":"","source_url":"https://coinex.medium.com/coinex-updates-on-recent-hot-wallets-hack-780a600dc846"},{"date":"2023-09-13","event":"ZachXBT publicly identifies wallet address overlap between CoinEx hacker and Stake.com hacker (attributed to Lazarus Group), suggesting North Korean origin. Elliptic corroborates, noting funds routed through Lazarus-linked bridge infrastructure. Estimated losses revised upward to $54 million after second batch of affected addresses identified.","source":"","source_url":"https://www.theblock.co/post/250691/north-korean-lazarus-group-likely-behind-coinexs-55-million-hack-zachxbt"},{"date":"2023-09-13","event":"CoinEx pledges 100% compensation to all affected users; states cold wallets were not targeted and remaining assets have been secured.","source":"","source_url":"https://www.ccn.com/news/coinex-suspends-operations-full-compensation/"},{"date":"2023-09-15","event":"The Record and other outlets publish detailed attribution reports linking CoinEx breach to North Korea's Lazarus Group based on Elliptic and ZachXBT blockchain forensics.","source":"","source_url":"https://therecord.media/coinex-cryptocurrency-heist-north-korea"},{"date":"2023-09-21","event":"CoinEx begins phased resumption of deposit and withdrawal services for select assets after security infrastructure overhaul.","source":"","source_url":"https://beincrypto.com/coinex-resumes-deposits-withdrawals/"},{"date":"2023-11-29","event":"U.S. Treasury OFAC sanctions Sinbad.io Bitcoin mixer, explicitly citing its use in laundering funds stolen from CoinEx and other Lazarus Group hacks. FBI and Dutch and Finnish law enforcement seize the Sinbad.io domain.","source":"","source_url":"https://home.treasury.gov/news/press-releases/jy1933"}]},"v":1}