Hacks & scams / Hack
60severity
HackcontainedEthereumTRONBitcoinAvalanche
Atomic Wallet hack: Atomic Wallet users lost an estimated $100M+ in June 2023; Elliptic links the theft to North Korea's Lazarus Group
2023-06-02 · updated 2026-10-31 05:36 UTC · by Sentinel, VaultX incident desk
Reported loss$100MReported as more than $100M (Elliptic, as reported by Reuters and CoinDesk). Earlier reporting put the total at about $35M, and one source cites a $129M Chainalysis estimate. None of these figures is confirmed by Atomic Wallet.
AttributionElliptic assessed with high confidence that the Lazarus Group was responsible, based on laundering patterns (per Reuters and CertiK-cited reporting). Reuters reported Elliptic's conclusion that North Korea-backed hackers stole the funds. One research note says the FBI attributed the incident to TraderTraitor-affiliated actors (also known as Lazarus Group and APT38); this was not independently verified here.
Response score55/100Attack-stopping steps and cooperation with exchanges were reported quickly, but transparency on user counts was inconsistent, the attack vector was not explained, and no compensation was confirmed.
Severity60/100Roughly $100M+ (reported) across thousands of wallets, with state-linked attribution; significant but not among the largest crypto thefts.
In early June 2023, users of the Atomic Wallet software wallet reported unauthorized drains of their funds. Early estimates were about $35M, and later analysis reported by Reuters and Elliptic put the total above $100M across thousands of wallets. Elliptic assessed with high confidence that the Lazarus Group was responsible, based on laundering patterns, and Atomic Wallet has not publicly explained how attackers gained access.
Get instant hack alerts
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
What happened
On June 2–3, 2023, users began reporting unauthorized transactions that drained their Atomic Wallet holdings. Atomic later said it was investigating, that fewer than 1% of monthly active users appeared affected, and that it had halted app downloads and updates.
Estimates rose over the following days. The initial public figure was about $35M. By mid-June, Elliptic's updated estimate was more than $100M in digital assets taken from numerous users. Reuters reported more than 5,500 wallets affected, while another research summary cited 4,100+ addresses. These counts conflict and are not confirmed.
Elliptic said the laundering pattern matched previous Lazarus Group operations. Reuters reported Elliptic's conclusion that North Korea-linked hackers were behind the heist. TechCrunch's June 8 coverage also linked the attack to North Korean hackers and named Lazarus.
Atomic Wallet's public statements said it was liaising with authorities and reporting victim addresses to exchanges and blockchain analytics firms. A June 22 statement said the company would work on a legal framework for seizing frozen deposits and distributing them to affected users, which was presented as a future step.
How it worked
Atomic Wallet has not publicly confirmed how the initial compromise happened. SecurityWeek reported that users' private keys may have been exposed beforehand. DN.institute, a secondary summary, said private keys were not properly secured and that an attacker obtained them and made unauthorized transactions. This is not a primary forensic finding.
Kaspersky said one plausible explanation was a fake trojanized Atomic Wallet build or a compromise of the developers or official application. Kaspersky presented this as a hypothesis, not a confirmed finding.
After draining wallets, the attackers reportedly moved funds through Ethereum and TRON, swapped assets through DEXs, and used cross-chain bridges (including Avalanche Bridge and THORChain), mixers (notably Sinbad), and exchanges such as Garantex to obscure the trail. Chainalysis reportedly described chain-hopping to Bitcoin and consolidation there.
Timeline
- 2023-06-02Users begin reporting unauthorized drains from Atomic Wallet (per DN.institute and SecurityWeek reporting).
- 2023-06-03Atomic Wallet says it received reports of unauthorized transactions, halts app downloads and updates, and starts an investigation with analytics firms and exchanges.
- 2023-06-05Atomic Wallet reportedly says fewer than 0.1% of users were affected and that no new cases were confirmed since June 3. Other research cites under 1% of monthly active users, so the figures conflict.
- 2023-06-08TechCrunch reports North Korean hackers linked to the heist; it is unclear whether affected users will be compensated.
- 2023-06-13Reuters reports Elliptic's estimate of more than $100M stolen; CoinDesk reports funds moved via Garantex and Sinbad.
- 2023-06-14Reuters reports Estonian police investigating the hack, which was blamed on North Korea.
- 2023-06-20CoinDesk reports THORChain used to conceal stolen funds.
- 2023-06-22Atomic reportedly says it will work on a legal framework to seize frozen deposits and distribute them to affected users. Community members demand compensation.
- 2023-06-23Coverage reports a class action alleging more than $100M in crypto assets stolen.
- 2023-10-19Atomic Wallet says it has frozen $2M of suspicious deposits on centralized exchanges.
Where the money went
Funds were reportedly moved across Ethereum and TRON, swapped through DEXs and cross-chain bridges (Avalanche Bridge, THORChain), passed through the Sinbad mixer, sent to Garantex, and consolidated on Bitcoin. Elliptic reportedly helped freeze over $1M. Atomic Wallet reported freezing $2M of suspicious deposits on centralized exchanges. No full recovery is documented in the research.
The response
Atomic Wallet reportedly halted app downloads and updates on June 3, 2023, began an investigation, and worked with analytics firms and exchanges to report victim addresses and freeze funds. It reported freezing $2M on centralized exchanges by October 2023. The research found no confirmed reimbursement program or insurance fund for victims. Atomic's user-impact figures (under 1% versus under 0.1%) were inconsistent across statements.
Market and user impact
Thousands of user wallets were drained, and users reported losing savings. Users reported sharply negative sentiment and some received urgent warnings to move funds. Reporting focused on drained-wallet losses rather than a documented, sustained price impact on the broader market.
What people say
70% negative · 5% positive · the rest neutral · themes: stolen user funds, North Korea link, compensation demands, class action, inconsistent user-impact figures, partial freezes
How to protect yourself
- Never store large balances in a software wallet you have not verified. Download wallets only from official sources and check signatures or hashes where possible.
- Protect seed phrases and private keys offline. Never type them into a website, app, or support chat.
- Move funds to a new wallet quickly when a provider reports a security incident, and only restore from a seed you generated yourself.
- Verify claims of user-impact percentages against on-chain data, and treat early official figures as provisional.
- Builders should publish a clear incident timeline, root cause, and compensation policy early to limit user harm and mistrust.
Check a walletScan a tokenStill unknown
- The initial compromise vector: whether private keys were exposed, a trojanized build was distributed, or the developers' systems were breached.
- The true total loss: $35M, $100M, or $129M, and the true number of affected wallets (4,100+ or 5,500+).
- Whether the FBI attribution to TraderTraitor-affiliated actors is confirmed in a primary FBI document.
- Exact attacker addresses and on-chain transaction records; none are verified in the research.
- Whether any compensation fund or class action settlement has been paid to victims.
- How much of the stolen value was ultimately frozen or recovered.
Related on VaultX
Bybit Ethereum cold wallet hack: Bybit loses about $1.46B in ETH from a cold wallet; FBI…Hack report · On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets was compromised in a 'sophisticated…North Korea-linked crypto hacks 2026 (Binance $6.3B breach): Binance reports record…Hack report · Binance said a 'complex attack' affected about $6.3 billion in funds, which would be the largest…Aave market freezes over Binance-exploiter loan (USDT collateral / WETH borrow): Aave…Hack report · On 29 Oct 2026 a wallet reportedly linked to the Binance hot-wallet exploiter deposited about $60M…Bitcoin Hyper review: High riskReview · Anonymous presale with regulator warning, user reports of vanishing funds, no working mainnetBitcoin review: MixedReview · 18-year-old open-source network with no issuer; US regulators call it highly speculativePepe review: MixedReview · Meme coin with no roadmap, anonymous team, and a $16M multisig withdrawal that sparked rug-pull…Binance hit by reported $6.3B multi-chain theft; TraderTraitor link flaggedNews · Reports put Binance's multi-chain theft at about $6.3B, with ~$3B frozen. TRM Labs links it to…Bitcoin Heads for Worst October in 12 Years as Tech Sell-Off SpreadsNews · Bitcoin was reported near $77,000 and on track for its weakest October since 2014 as a tech…Polymarket explained: how prediction markets price real-world eventsGuide · How Polymarket works, how to read its Yes and No prices as probabilities, and what those prices…Hot and cold walletsGlossary · A hot wallet is connected to the internet (an app or browser extension); a cold wallet keeps keys…On-chain analysisGlossary · On-chain analysis studies public blockchain data such as transfers, wallet balances and exchange…Seed phraseGlossary · A seed phrase is the 12 or 24 words that can restore a crypto wallet. Whoever has it controls the…
Sources
- Atomic Wallet June 3rd event statement
- TechCrunch: North Korean hackers linked to Atomic Wallet crypto hack
- CFR: Targeting of Atomic Wallet cryptocurrency users
- Reuters: North Korean hackers stole $100 million in recent cryptocurrency heist, analysts say
- SecurityWeek: North Korean hackers blamed for $35 million Atomic Wallet crypto theft
- The Register: North Korea's Lazarus Group linked to Atomic Wallet heist
- Kaspersky: Top eight crypto scams 2023
- DN Institute: Atomic Wallet incident
- CoinDesk: Atomic Wallet hackers move stolen funds via OFAC-sanctioned exchange Garantex (Elliptic)
- CoinDesk: Atomic Wallet hackers use THORChain to conceal stolen $35M funds
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
Get new hack reports as they happen
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice. 
VaultX