CoinEx Hack
What happened
On September 12, 2023, CoinEx detected abnormal withdrawals from several hot-wallet addresses. Public reporting estimated the loss at about $55 million in assets across multiple networks; CoinEx later said it would fully compensate affected users. The company did not publicly establish the initial intrusion method.
The confirmed failure was hot-wallet control and key-management exposure. CoinEx’s public incident updates describe abnormal withdrawals and subsequent improvements including multisignature controls, offline key handling, physical separation, allowlists and monitoring, and do not identify the exact compromise mechanism.
How it happened
- An attacker gained control of CoinEx hot-wallet signing capability.
- Assets were transferred from wallets used for temporary exchange custody across Ethereum, BNB Chain, Tron, Bitcoin and other networks.
- CoinEx suspended withdrawals, moved remaining assets and rebuilt its wallet architecture.
- Blockchain researchers linked the activity to infrastructure associated with North Korean actors, although the access path is not established.
Protocol details
Evidence
- report @DeDotFiSecurity incident report twitter.com
- report CoinEx incident progress report coinex.com
- analysis North Korean attackers linked to $54M CoinEx hack coindesk.com
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis CoinEx asset security infrastructure upgrade coinex.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
