LCX Hack
Reported loss
$7.9M
Hot-wallet compromise; initial access unknown
What happened
On January 8, 2022, approximately $7.94 million in ETH and tokens was stolen from one LCX Ethereum hot wallet. LCX said its other wallets and customer personal data were unaffected. It paused deposits and withdrawals and committed its own funds to covering affected balances.
Technical root cause
Unauthorized access to a single hot wallet enabled the transfers. LCX did not publicly describe the initial access method in its incident report, so a specific private-key theft or software vulnerability is unconfirmed.
How it happened
- Unauthorized transfers drained the affected wallet between 23:23 and 23:37 CET.
- LCX paused deposits and withdrawals and contacted partners and authorities.
- Monerium disabled movement of approximately 611,000 EURe. Freezing these tokens did not by itself establish their return.
- LCX migrated assets to new infrastructure and reported that deposit and withdrawal services were fully restored on January 28.
Protocol details
Evidence
- report Report lcx.com
- report @lcx incident report twitter.com
- report @peckshield incident report twitter.com
- report Post-mortem rekt.news
- report Hot Wallet Incident Report lcx.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
