On 12 September 2023, CoinEx detected abnormal withdrawals from its hot wallets across many blockchains. The exchange said the preliminary cause was a leak of hot-wallet private keys, and estimates of the loss ranged from about $27M to $70M. CoinEx paused withdrawals, pledged 100% compensation to affected users, and reportedly resumed normal operations by 17 October 2023. Attribution to a North Korea-linked group has been reported, but CoinEx itself stressed the limits of on-chain attribution, and no recovery total is documented in the sources reviewed.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
According to CoinEx and media reports, the exchange detected anomalous withdrawals from its hot wallets on 12 September 2023. The company said the affected funds were a 'very small portion' of its total assets. It halted withdrawals and began moving remaining assets to safe wallets while it investigated.
CoinEx's own post listed stolen assets on a long list of chains: BTC, ETH, SOL, TRX, XRP, BNB, XLM, TON, ETHW, KDA, BCH, XDAG, TOMO, VET, LTC, DOGE, AIDOGE and ETC. Its breakdown included 231 BTC, 4,953 ETH, 135,600 SOL, 137,127,860 TRX, 12,625,364 XRP, 29,552 BNB, 2,214,700 KDA, 2,220 BCH, 229,291,485 XDAG, 259,494 TOMO, 42,422,648 VET, 5,435 LTC, 16,695,400 DOGE, 325,430 TON, 124,600 ETHW and 7,434 ETC, plus a very large AIDOGE amount.
Loss estimates changed as analysts traced more wallets. Early on-chain estimates (Cyvers, per CoinEx coverage) were about $27M. Research cited by The Record was about $31M. PeckShield estimated about $43M (roughly $19M ETH, $11M TRX, $6.4M BSC, $6M BTC and $295K MATIC). CertiK Alert and later reporting put it near $53M. One report says CoinEx later updated its own estimate to $70M.
Note: the case was labelled 'October 2023', but the research dates the hack to 12 September 2023. October 2023 is when operations were reportedly fully restored.
CoinEx said the preliminary cause was leakage of hot-wallet private keys. With those keys, an attacker can sign withdrawal transactions as if they were the exchange. Later reporting and security analyses described it as a private-key compromise affecting hot wallets, not a smart-contract bug. Because the keys covered many chains, the attacker could drain many assets in parallel. How the keys leaked has not been explained in the sources reviewed.
On-chain researchers and media reported that the stolen funds were moved across several chains, and some analysis suggested cross-chain routes, bridges and exchanges were used to launder them. The sources reviewed do not give a full transaction graph or verify specific mixers, bridge contracts or exchange deposit addresses. CoinEx said it was tracking the wallets and coordinating with other projects and exchanges to 'formulate a solution', but it did not quantify frozen or recovered assets. No confirmed recovery figure was found.
| Address | Chain | Role | Source |
|---|---|---|---|
0xce013682eddefaca8c94fe56a43a04212ebe4673 | Ethereum | attacker (suspicious address published by CoinEx) | source |
0x8bf8cd7F001D0584F98F53a3d82eD0bA498cC3dE | Ethereum | attacker (suspicious address published by CoinEx) | source |
0xCC1AE485b617c59a7c577C02cd07078a2bcCE454 | Ethereum | attacker (suspicious address published by CoinEx) | source |
0x483D88278Cbc0C9105c4807d558E06782AEFf584 | Ethereum | attacker (suspicious address published by CoinEx) | source |
1BHNb9UJy4cWFB5wywZkTVgoNB4JbFmswH | Bitcoin | attacker (suspicious address published by CoinEx) | source |
TP75t6owoqXxskLq6FB2R37PymNTmohq9L | TRON | attacker (suspicious address published by CoinEx) | source |
TPFUjxQzG88Vwynrpj2W61ZAkQ9W2QYgAQ | TRON | attacker (suspicious address published by CoinEx) | source |
rpQxVcjVF2fC23r3xKyJS53jw8d5SRhZQf | XRP Ledger | attacker (suspicious address published by CoinEx) | source |
Every address is from a public source. Check any wallet in the dirty wallet checker.
CoinEx halted withdrawals and moved remaining assets to safe wallets, according to its own statements. It published suspicious addresses, said it was coordinating with other projects and exchanges, and reorganized its security mechanisms. The CEO apologized and pledged 100% compensation to affected users. Withdrawals resumed in stages after security work, and normal operations were reportedly back by 17 October 2023, with users told to use new deposit/withdrawal addresses. The sources reviewed show no clearly documented regulator or police action tied to this hack. CoinEx also published an open plea for dialogue with the hacker, per a Bitcoin.com headline.
CoinEx initially called the losses a 'very small portion' of total assets, and the sources report no precise price impact on CoinEx-related assets or the wider market. Users faced a roughly month-long disruption before normal operations reportedly resumed, but were promised full compensation. A secondary report says CoinEx received 'full support and positive feedback' from customers, though that claim is not backed by primary user posts. The case resurfaced in coverage in which the CoinEx founder claimed Binance's reported $6.3B hack could have been prevented. That claim is context only and was not examined here.
45% negative · 20% positive · the rest neutral · themes: hot-wallet key management, full compensation pledge, speed of withdrawal halt, uncertainty over loss size, North Korea attribution caveats
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX