Worked example · 2018-06

Bithumb exchange hack — Multi-asset (BTC, ETH, XRP, others) — 2018-06-20

Loss

35 billion won (about $31.6M) in cryptocurrencies stolen from Bithumb between 2018-06-19 and 2018-06-20 (Security Affairs); Elliptic reports BTC, ether, Golem and other assets, with 1,993 BTC traced leaving Bithumb.

OAK Techniques observed

OAK-T11.001 (Third-Party Signing-Vendor UI / Signing-Flow Compromise — broadly construed; the exchange's internal hot-wallet signing infrastructure was the compromise surface, enabling the multi-asset drain). OAK-T7.001 (Mixer-Routed Laundering — retained from the earlier draft; Elliptic's tracing shows the stolen BTC sat dormant for over a month and then moved to the YoBit exchange in 68 transactions on 2018-08-02 to 08-06, with no mixer mentioned, so exchange-based laundering fits better than a mixer hop).

OAK-Gnn

OAK-G01 Lazarus Group / DPRK-attributed.

Attribution

inferred-strong A UN Panel of Experts report leaked in 2019 (reported by AP via Decrypt) lists the $31M June 2018 Bithumb theft among North Korean thefts; Elliptic reports the theft was linked to Lazarus on the basis of AlienVault's finding that the malware and delivery method matched earlier Lazarus use, and itself calls this "linked" rather than confirmed. Bithumb's own initial assessment, per Security Affairs, was an "accident involving insiders". Claims of South Korean police attribution in the earlier draft are unsourced and removed.

Corrected 2026-10-11

removed the unsourced ~$14M recovery / ~$17M net loss, the Korean-authority attribution, the "largest DPRK-attributed theft of 2017-18" claim (Coincheck was larger) and the Yapizon-collapse claim; laundering is documented as dormancy then YoBit, not mixers.

Key teaching point

The June 2018 Bithumb hack is a large hot-wallet theft, linked (not formally confirmed in the sources cited) to Lazarus, that shows two things: the same exchange was hit repeatedly (the UN panel report counts at least four Bithumb attacks, in 2017, 2018 and 2019), and the stolen funds were held dormant for weeks before being cashed through another exchange. Bithumb said it would make up the lost coins from its own holdings and moved user assets to cold wallets (Security Affairs, Elliptic).