# CoinEx hot-wallet hack: CoinEx loses an estimated $27M-$70M after hot-wallet private keys leak; users promised full compensation
Source page: https://vaultx.llc/hacks/coinex-hack-october-2023 · VaultX incident report by Sentinel · first published 2026-11-04, updated 2026-11-04
- Date: 2023-09-12
- Reported loss: $53.0M (Reported range of about $27M to $70M depending on source and date. Many reports cluster at $43M-$53M (PeckShield about $43M; CertiK Alert and later reports about $53M). One report says CoinEx's own updated estimate was $70M. Figures are reported, not independently confirmed.)
- Attribution: Reportedly a North Korea-affiliated group. CoinEx said the incident had been attributed by multiple investigations to a North Korea-affiliated group, while cautioning that blockchain-analytics conclusions are method-dependent and not definitive on their own.
- Chains: Ethereum, Tron, BNB Chain, Polygon, Bitcoin, Solana, XRP Ledger, TON, Ethereum PoW, Kadena, Bitcoin Cash, XDAG, TomoChain, VeChain, Litecoin, Dogecoin, Stellar, Ethereum Classic
- Status: contained
- Severity: 52/100
- Response score: 72/100 (Withdrawals were halted quickly, addresses were published and 100% compensation was pledged with operations restored in about five weeks. Points lost for initially downplaying the loss as a 'very small portion', shifting loss estimates, and no documented recovery or detailed post-mortem on how the keys leaked.)
On 12 September 2023, CoinEx detected abnormal withdrawals from its hot wallets across many blockchains. The exchange said the preliminary cause was a leak of hot-wallet private keys, and estimates of the loss ranged from about $27M to $70M. CoinEx paused withdrawals, pledged 100% compensation to affected users, and reportedly resumed normal operations by 17 October 2023. Attribution to a North Korea-linked group has been reported, but CoinEx itself stressed the limits of on-chain attribution, and no recovery total is documented in the sources reviewed.

**What happened**
According to CoinEx and media reports, the exchange detected anomalous withdrawals from its hot wallets on 12 September 2023. The company said the affected funds were a 'very small portion' of its total assets. It halted withdrawals and began moving remaining assets to safe wallets while it investigated.
CoinEx's own post listed stolen assets on a long list of chains: BTC, ETH, SOL, TRX, XRP, BNB, XLM, TON, ETHW, KDA, BCH, XDAG, TOMO, VET, LTC, DOGE, AIDOGE and ETC. Its breakdown included 231 BTC, 4,953 ETH, 135,600 SOL, 137,127,860 TRX, 12,625,364 XRP, 29,552 BNB, 2,214,700 KDA, 2,220 BCH, 229,291,485 XDAG, 259,494 TOMO, 42,422,648 VET, 5,435 LTC, 16,695,400 DOGE, 325,430 TON, 124,600 ETHW and 7,434 ETC, plus a very large AIDOGE amount.
Loss estimates changed as analysts traced more wallets. Early on-chain estimates (Cyvers, per CoinEx coverage) were about $27M. Research cited by The Record was about $31M. PeckShield estimated about $43M (roughly $19M ETH, $11M TRX, $6.4M BSC, $6M BTC and $295K MATIC). CertiK Alert and later reporting put it near $53M. One report says CoinEx later updated its own estimate to $70M.
Note: the case was labelled 'October 2023', but the research dates the hack to 12 September 2023. October 2023 is when operations were reportedly fully restored.

**How it worked**
CoinEx said the preliminary cause was leakage of hot-wallet private keys. With those keys, an attacker can sign withdrawal transactions as if they were the exchange. Later reporting and security analyses described it as a private-key compromise affecting hot wallets, not a smart-contract bug. Because the keys covered many chains, the attacker could drain many assets in parallel. How the keys leaked has not been explained in the sources reviewed.

**Where the money went**
On-chain researchers and media reported that the stolen funds were moved across several chains, and some analysis suggested cross-chain routes, bridges and exchanges were used to launder them. The sources reviewed do not give a full transaction graph or verify specific mixers, bridge contracts or exchange deposit addresses. CoinEx said it was tracking the wallets and coordinating with other projects and exchanges to 'formulate a solution', but it did not quantify frozen or recovered assets. No confirmed recovery figure was found.

**The response**
CoinEx halted withdrawals and moved remaining assets to safe wallets, according to its own statements. It published suspicious addresses, said it was coordinating with other projects and exchanges, and reorganized its security mechanisms. The CEO apologized and pledged 100% compensation to affected users. Withdrawals resumed in stages after security work, and normal operations were reportedly back by 17 October 2023, with users told to use new deposit/withdrawal addresses. The sources reviewed show no clearly documented regulator or police action tied to this hack. CoinEx also published an open plea for dialogue with the hacker, per a Bitcoin.com headline.

**Impact**
CoinEx initially called the losses a 'very small portion' of total assets, and the sources report no precise price impact on CoinEx-related assets or the wider market. Users faced a roughly month-long disruption before normal operations reportedly resumed, but were promised full compensation. A secondary report says CoinEx received 'full support and positive feedback' from customers, though that claim is not backed by primary user posts. The case resurfaced in coverage in which the CoinEx founder claimed Binance's reported $6.3B hack could have been prevented. That claim is context only and was not examined here.

**Wallets linked to this case**
- 0xce013682eddefaca8c94fe56a43a04212ebe4673 (Ethereum, attacker (suspicious address published by CoinEx)) source: https://x.com/coinexcom/status/1701662057496731975
- 0x8bf8cd7F001D0584F98F53a3d82eD0bA498cC3dE (Ethereum, attacker (suspicious address published by CoinEx)) source: https://x.com/coinexcom/status/1701662057496731975
- 0xCC1AE485b617c59a7c577C02cd07078a2bcCE454 (Ethereum, attacker (suspicious address published by CoinEx)) source: https://x.com/coinexcom/status/1701662057496731975
- 0x483D88278Cbc0C9105c4807d558E06782AEFf584 (Ethereum, attacker (suspicious address published by CoinEx)) source: https://x.com/coinexcom/status/1701662057496731975
- 1BHNb9UJy4cWFB5wywZkTVgoNB4JbFmswH (Bitcoin, attacker (suspicious address published by CoinEx)) source: https://x.com/coinexcom/status/1701662057496731975
- TP75t6owoqXxskLq6FB2R37PymNTmohq9L (TRON, attacker (suspicious address published by CoinEx)) source: https://x.com/coinexcom/status/1701662057496731975
- TPFUjxQzG88Vwynrpj2W61ZAkQ9W2QYgAQ (TRON, attacker (suspicious address published by CoinEx)) source: https://x.com/coinexcom/status/1701662057496731975
- rpQxVcjVF2fC23r3xKyJS53jw8d5SRhZQf (XRP Ledger, attacker (suspicious address published by CoinEx)) source: https://x.com/coinexcom/status/1701662057496731975

**Timeline**
- 2023-09-12 CoinEx detects anomalous hot-wallet withdrawals, halts withdrawals and begins an emergency response, according to CoinEx.
- 2023-09-12 Early on-chain estimates (Cyvers, per CoinEx coverage) put losses at about $27M, mainly ETH, TRX and MATIC.
- 2023-09 (mid) Other estimates follow: about $31M (The Record), about $43M (PeckShield), then about $53M (CertiK Alert and later reports).
- 2023-09 (mid) CoinEx says the preliminary cause is leakage of hot-wallet private keys and lists the affected assets and chains.
- 2023-09 (mid) CoinEx posts suspicious attacker-linked addresses on X and says it is working with projects and exchanges to track funds.
- 2023-09 (mid) The CEO apologizes and pledges 100% compensation to affected users, according to a secondary report.
- 2023-10-17 Normal operations reportedly restored, with users told to use new deposit/withdrawal addresses (secondary report).

**How to protect yourself**
- Hot-wallet private keys are a single point of failure. Exchanges should limit hot-wallet balances, use multi-party computation or multisig signing, and separate keys per chain.
- Monitor withdrawals for anomalies and have a rapid kill-switch, as CoinEx's detection and halt show.
- Users should avoid keeping large balances on exchanges, and should check an exchange's compensation and proof-of-reserves policies.
- After an incident, use only the new deposit addresses an exchange officially announces, and beware phishing that exploits the confusion.
- Treat early loss figures as provisional: here they ranged from $27M to $70M as analysis progressed.
- Attribution from on-chain analysis has limits, as CoinEx itself cautioned.

**Still unknown**
- How the hot-wallet private keys were leaked (insider, malware, infrastructure compromise or other).
- The definitive total loss, since estimates range from $27M to $70M and CoinEx's own breakdown is only partly itemized in USD.
- Whether any stolen funds were frozen or recovered.
- The exact laundering path: mixers, bridges and exchange deposit addresses are not verified in the sources.
- The strength of the evidence for North Korea attribution, and the timing of CoinEx's attribution statement.
- The exact date CoinEx published the wallet addresses on X (only mid-September 2023 is implied).
- Details of how compensation was funded and paid out, and whether any regulatory or police action was taken, since none is documented in the sources reviewed.

**Sources**
- CoinEx announcement https://www.coinex.com/en/announcements/detail/19187420867348
- BleepingComputer: Hackers steal $53 million worth of cryptocurrency from CoinEx https://www.bleepingcomputer.com/news/security/hackers-steal-53-million-worth-of-cryptocurrency-from-coinex/
- The Record: CoinEx confirms hack after $31 million allegedly stolen https://therecord.media/coinex-confirms-hack-after-31-million-allegedly-stolen
- Unchained: CoinEx hot wallets drained of $27 million in suspected hack https://unchainedcrypto.com/coinex-hot-wallets-drained-of-27-million-in-suspected-hack/

---
VaultX: free crypto news and intelligence, https://vaultx.llc