Summary
WOO X is a centralized cryptocurrency exchange founded in 2019 and incubated by Taiwanese quantitative trading firm Kronos Research, offering spot and derivatives trading with a focus on deep liquidity and low fees. The exchange has experienced two significant security events: a November 2023 liquidity crisis triggered by a $26 million hack of its primary market maker Kronos Research, and a July 2025 $14 million breach of nine user accounts attributed to a North Korean state-sponsored group (UNC4899/Lazarus) via phishing of a developer. Both incidents resulted in user compensation from company reserves, though the pattern of security failures and structural dependency on Kronos Research represent elevated counterparty and operational risk.
Connected Entities
1 entities- + 3 more
Timeline(13 events)
2018-01-01
Kronos Research founded in Taiwan as a quantitative high-frequency trading firm by Jack Tan and Mark Pimentel.
2019-01-01
WOO Network founded by Kronos Research co-founders Jack Tan and Mark Pimentel, incubated by Kronos Research.
2021-08-01
WOO X launches publicly as a centralized exchange, billing itself as the first crypto exchange to use a Payment for Order Flow model.
2022-09-08
WOO Network receives AML registration approval from Taiwan's Financial Supervisory Commission, the only foreign applicant among 24 approved platforms.
2023-08-01
Two Kronos Research engineers are convicted by a Taipei court of tampering with trading algorithms over unpaid bonuses, causing approximately $1.4 million in losses.
2023-11-18
Kronos Research's exchange API keys are compromised by an external attacker; approximately $26 million is stolen. WOO X suspends trading and withdrawals due to Kronos being its primary market maker.
2023-11-19
WOO X restores spot and perpetual trading after onboarding alternative market makers. Exchange confirms 227 users experienced liquidations and states all will be compensated.
2023-11-28
Kronos Research publicly offers the hacker a 10% bounty to return funds. The offer is not accepted.
2024-09-01
Seychelles VASP Act 2024 comes into force, requiring all crypto businesses operating from Seychelles to hold a VASP license. WOO X's compliance status with this requirement is not publicly confirmed.
2025-06-28
Alleged initial contact by UNC4899/Lazarus Group threat actor with a WOO X developer via open-source software forum, beginning the attack chain that leads to the July 2025 breach.
2025-07-24
WOO X detects unauthorized withdrawals of $14 million from nine user accounts across Bitcoin, Ethereum, BNB, and Arbitrum networks. Withdrawals are suspended. Attack attributed to North Korean state-sponsored group UNC4899.
2025-07-25
WOO X confirms $14 million in losses and pledges 100% compensation from WOO treasury reserves. Trading remains operational throughout incident.
2025-10-15
FusionX Digital, a Web3 private equity fund, announced as new operator of WOO X centralized exchange. Sheldon Xia, founder of BitMart, joins a newly established Global Strategic Committee.
Decision Log
- hash: 4XerYiZqPteTJ4TCLpth763wRV9GKryuEsss5ioANfHn
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:22 AM
last updated: 5/20/2026, 3:37:14 AM
avoid.net — verified advice for a post-truth world