# Atomic Wallet hack: Atomic Wallet users lost an estimated $100M+ in June 2023; Elliptic links the theft to North Korea's Lazarus Group
Source page: https://vaultx.llc/hacks/atomic-wallet-hack-2023 · VaultX incident report by Sentinel · first published 2026-10-31, updated 2026-10-31
- Date: 2023-06-02
- Reported loss: $100M (Reported as more than $100M (Elliptic, as reported by Reuters and CoinDesk). Earlier reporting put the total at about $35M, and one source cites a $129M Chainalysis estimate. None of these figures is confirmed by Atomic Wallet.)
- Attribution: Elliptic assessed with high confidence that the Lazarus Group was responsible, based on laundering patterns (per Reuters and CertiK-cited reporting). Reuters reported Elliptic's conclusion that North Korea-backed hackers stole the funds. One research note says the FBI attributed the incident to TraderTraitor-affiliated actors (also known as Lazarus Group and APT38); this was not independently verified here.
- Chains: Ethereum, TRON, Bitcoin, Avalanche
- Status: contained
- Severity: 60/100
- Response score: 55/100 (Attack-stopping steps and cooperation with exchanges were reported quickly, but transparency on user counts was inconsistent, the attack vector was not explained, and no compensation was confirmed.)
In early June 2023, users of the Atomic Wallet software wallet reported unauthorized drains of their funds. Early estimates were about $35M, and later analysis reported by Reuters and Elliptic put the total above $100M across thousands of wallets. Elliptic assessed with high confidence that the Lazarus Group was responsible, based on laundering patterns, and Atomic Wallet has not publicly explained how attackers gained access.

**What happened**
On June 2–3, 2023, users began reporting unauthorized transactions that drained their Atomic Wallet holdings. Atomic later said it was investigating, that fewer than 1% of monthly active users appeared affected, and that it had halted app downloads and updates.
Estimates rose over the following days. The initial public figure was about $35M. By mid-June, Elliptic's updated estimate was more than $100M in digital assets taken from numerous users. Reuters reported more than 5,500 wallets affected, while another research summary cited 4,100+ addresses. These counts conflict and are not confirmed.
Elliptic said the laundering pattern matched previous Lazarus Group operations. Reuters reported Elliptic's conclusion that North Korea-linked hackers were behind the heist. TechCrunch's June 8 coverage also linked the attack to North Korean hackers and named Lazarus.
Atomic Wallet's public statements said it was liaising with authorities and reporting victim addresses to exchanges and blockchain analytics firms. A June 22 statement said the company would work on a legal framework for seizing frozen deposits and distributing them to affected users, which was presented as a future step.

**How it worked**
Atomic Wallet has not publicly confirmed how the initial compromise happened. SecurityWeek reported that users' private keys may have been exposed beforehand. DN.institute, a secondary summary, said private keys were not properly secured and that an attacker obtained them and made unauthorized transactions. This is not a primary forensic finding.
Kaspersky said one plausible explanation was a fake trojanized Atomic Wallet build or a compromise of the developers or official application. Kaspersky presented this as a hypothesis, not a confirmed finding.
After draining wallets, the attackers reportedly moved funds through Ethereum and TRON, swapped assets through DEXs, and used cross-chain bridges (including Avalanche Bridge and THORChain), mixers (notably Sinbad), and exchanges such as Garantex to obscure the trail. Chainalysis reportedly described chain-hopping to Bitcoin and consolidation there.

**Where the money went**
Funds were reportedly moved across Ethereum and TRON, swapped through DEXs and cross-chain bridges (Avalanche Bridge, THORChain), passed through the Sinbad mixer, sent to Garantex, and consolidated on Bitcoin. Elliptic reportedly helped freeze over $1M. Atomic Wallet reported freezing $2M of suspicious deposits on centralized exchanges. No full recovery is documented in the research.

**The response**
Atomic Wallet reportedly halted app downloads and updates on June 3, 2023, began an investigation, and worked with analytics firms and exchanges to report victim addresses and freeze funds. It reported freezing $2M on centralized exchanges by October 2023. The research found no confirmed reimbursement program or insurance fund for victims. Atomic's user-impact figures (under 1% versus under 0.1%) were inconsistent across statements.

**Impact**
Thousands of user wallets were drained, and users reported losing savings. Users reported sharply negative sentiment and some received urgent warnings to move funds. Reporting focused on drained-wallet losses rather than a documented, sustained price impact on the broader market.

**Timeline**
- 2023-06-02 Users begin reporting unauthorized drains from Atomic Wallet (per DN.institute and SecurityWeek reporting).
- 2023-06-03 Atomic Wallet says it received reports of unauthorized transactions, halts app downloads and updates, and starts an investigation with analytics firms and exchanges.
- 2023-06-05 Atomic Wallet reportedly says fewer than 0.1% of users were affected and that no new cases were confirmed since June 3. Other research cites under 1% of monthly active users, so the figures conflict.
- 2023-06-08 TechCrunch reports North Korean hackers linked to the heist; it is unclear whether affected users will be compensated.
- 2023-06-13 Reuters reports Elliptic's estimate of more than $100M stolen; CoinDesk reports funds moved via Garantex and Sinbad.
- 2023-06-14 Reuters reports Estonian police investigating the hack, which was blamed on North Korea.
- 2023-06-20 CoinDesk reports THORChain used to conceal stolen funds.
- 2023-06-22 Atomic reportedly says it will work on a legal framework to seize frozen deposits and distribute them to affected users. Community members demand compensation.
- 2023-06-23 Coverage reports a class action alleging more than $100M in crypto assets stolen.
- 2023-10-19 Atomic Wallet says it has frozen $2M of suspicious deposits on centralized exchanges.

**How to protect yourself**
- Never store large balances in a software wallet you have not verified. Download wallets only from official sources and check signatures or hashes where possible.
- Protect seed phrases and private keys offline. Never type them into a website, app, or support chat.
- Move funds to a new wallet quickly when a provider reports a security incident, and only restore from a seed you generated yourself.
- Verify claims of user-impact percentages against on-chain data, and treat early official figures as provisional.
- Builders should publish a clear incident timeline, root cause, and compensation policy early to limit user harm and mistrust.

**Still unknown**
- The initial compromise vector: whether private keys were exposed, a trojanized build was distributed, or the developers' systems were breached.
- The true total loss: $35M, $100M, or $129M, and the true number of affected wallets (4,100+ or 5,500+).
- Whether the FBI attribution to TraderTraitor-affiliated actors is confirmed in a primary FBI document.
- Exact attacker addresses and on-chain transaction records; none are verified in the research.
- Whether any compensation fund or class action settlement has been paid to victims.
- How much of the stolen value was ultimately frozen or recovered.

**Sources**
- Atomic Wallet June 3rd event statement https://atomicwallet.io/blog/articles/june-3rd-event-statement
- TechCrunch: North Korean hackers linked to Atomic Wallet crypto hack https://techcrunch.com/2023/06/08/north-korean-hackers-linked-to-atomic-wallet-crypto-hack/
- CFR: Targeting of Atomic Wallet cryptocurrency users https://www.cfr.org/cyber-operations/targeting-of-atomic-wallet-cryptocurrency-users
- Reuters: North Korean hackers stole $100 million in recent cryptocurrency heist, analysts say https://www.reuters.com/world/north-korean-hackers-stole-100-million-recent-cryptocurrency-heist-analysts-2023-06-13/
- SecurityWeek: North Korean hackers blamed for $35 million Atomic Wallet crypto theft https://www.securityweek.com/north-korean-hackers-blamed-for-35-million-atomic-wallet-crypto-theft/
- The Register: North Korea's Lazarus Group linked to Atomic Wallet heist https://www.theregister.com/security/2023/06/09/north-koreas-lazarus-group-linked-to-atomic-wallet-heist/1405267
- Kaspersky: Top eight crypto scams 2023 https://www.kaspersky.com/blog/top-eight-crypto-scams-2023/48489/
- DN Institute: Atomic Wallet incident https://dn.institute/research/cyberattacks/incidents/2023-06-02-atomic-wallet/
- CoinDesk: Atomic Wallet hackers move stolen funds via OFAC-sanctioned exchange Garantex (Elliptic) https://www.coindesk.com/tech/2023/06/13/atomic-wallet-hackers-move-stolen-funds-via-ofac-sanctioned-exchange-garantex-elliptic
- CoinDesk: Atomic Wallet hackers use THORChain to conceal stolen $35M funds https://www.coindesk.com/business/2023/06/20/atomic-wallet-hackers-use-thorchain-to-conceal-stolen-35m-funds

---
VaultX: free crypto news and intelligence, https://vaultx.llc