Phemex Hack
Reported loss
$85.0M
Private Key Compromised (Unknown Method)
What happened
Phemex detected unauthorized activity in a hot wallet on 23 January 2025. The exchange suspended deposits and withdrawals, isolated affected devices, and gradually restored services while saying cold-wallet holdings were unaffected.
Technical root cause
The operator confirmed a hot-wallet security incident but did not publish a definitive initial-access mechanism. Independent estimates differ, and the precise loss remains unconfirmed.
How it happened
- Phemex detected unusual hot-wallet activity at about 11:30 UTC.
- It suspended wallet functions and investigated with security firms and law enforcement.
- Withdrawals resumed in stages after wallet infrastructure and monitoring controls were upgraded.
Protocol details
Classification
Infrastructure / CeFi / Key Compromise
Protocol Type
CEX
Protocol links
Website
@Phemex_official
Evidence
- report @PeckShieldAlert incident report x.com
- report @lookonchain incident report x.com
- report Immunefi Crypto Losses Q1 2025 Report immunefi.com
- analysis Website reference cointelegraph.com
- analysis Website reference thecryptobasic.com
- analysis DeFiLlama defillama.com
- analysis Phemex Hot Wallet Security Incident Update and Timeline phemex.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
