Lazarus Group may be behind the attack on CoinEx

Blockchain security company SlowMist has revealed two discoveries regarding the hacker attack against the CoinEx exchange that occurred on Tuesday (12). According to company data, the attack caused a loss of US$54 million, or around US$260 million in current values. The sum is twice as large as the previously revealed amount.

But, in addition to the higher value, SlowMist also identified the possible perpetrators of the attack as the Lazarus group, from North Korea. According to detective ZackXBT, the group used an address linked to another attack in the attack on CoinEx, this time against Optimism. This attack was authored by the group, which helped link Lazarus to CoinEx.

“The attacks on CoinEx, Stake and Alphapo may have links to North Korean hackers known as the Lazarus Group,” said SlowMist. The company revealed a connection between the addresses associated with the three attacks.

Understand the case

On Tuesday, as CriptoFácil reported, CoinEx recorded large outflows of funds to an address that had no prior history with the exchange. This action aroused suspicions of an attack that were soon confirmed with an official announcement from the exchange.

Initially, CoinEx stated that the hackers caused losses of US$27 million. However, SlowMist noted that losses from exploration reached more than $55 million. Following the hack, CoinEx Global assured users that their assets were safe and that affected parties would “receive 100% compensation” for any losses.

Following the attack, CoinEx temporarily suspended deposits and withdrawals for greater security. The exchange continues to monitor the situation and has promised to release a comprehensive report on the incident. At the same time, CoinEx also began investigating the origin of the attack.

Who also identified Lazarus as the author of the attack was blockchain detective ZackXBT. On his account on the social network X, the detective published a list of addresses associated with previous attacks by the group. The addresses actually match those that were present at the attack on CoinEx.

Based on their behavior on the network, the hackers responsible for the attack appear to be connected to the recent scam that stole $41 million from the betting site Stake. On September 7, the FBI concluded that the attack on Stake was carried out by the Lazarus Group.

Linked to the North Korean government, Lazarus is involved in some of the biggest attacks in the history of cryptocurrencies. For example, the attack on Ronin from Axie Infinity last year and the attack on Optimism this year.