OAK — OnChain Attack Knowledge

Worked example · 2023-09

CoinEx exchange hot-wallet compromise — Multi-chain (ETH, TRON, Polygon) — 2023-09-12

Loss
approximately $53-54M per address-tracking firms (SecurityWeek: roughly $53M; Risky Business: about $54M) across Ether, Tron and Matic (Polygon) assets and other chains [riskybizcoinex] [securityweekcoinex]. CoinEx itself did not disclose the amount [securityweekcoinex]. CoinEx's preliminary cause was the leakage of hot-wallet private keys [securityweekcoinex].
Corrected 2026-10-11
loss restated from $54-70M to ~$53-54M (the $70M figure appears in one low-quality source only); cause stated as hot-wallet private-key leakage per CoinEx; the claimed FBI/CISA joint advisory attributing CoinEx is removed — cited sources show suspicion by Elliptic/CertiK/ZachXBT via links to Stake.com laundering addresses, and the FBI attributing Stake.com, not CoinEx; the reimbursement programme and post-mortem claims are unverified.
OAK Techniques observed
OAK-T11.001 (Third-Party Signing-Vendor UI / Signing-Flow Compromise — broadly construed; hot-wallet private keys leaked, and hot wallets were drained across multiple chains [securityweekcoinex]). OAK-T7.001 (Mixer-Routed Laundering — some stolen funds went to an address that also held funds from the Stake.com hack [riskybizcoinex]).
OAK-Gnn
OAK-G01 Lazarus Group / DPRK-attributed.
Attribution
inferred-strong CoinEx did not formally link the hack to North Korea. ZachXBT found that some stolen CoinEx funds went to the same address holding funds from the Stake.com hack, and a CertiK report confirmed that and noted further links [riskybizcoinex]; SecurityWeek reports CertiK says Lazarus is responsible and links it to the Atomic Wallet, Alphapo, CoinsPaid and Stake.com heists [securityweekcoinex]. No FBI or CISA statement specific to CoinEx is cited here (the FBI linked Stake.com, not CoinEx, to Lazarus [riskybizcoinex]). The inferred-strong rating therefore rests on private-firm on-chain linkage.
Key teaching point
CoinEx shows that leaked hot-wallet private keys can drain an exchange across several independent chains at once (Ether, Tron, Matic) [riskybizcoinex]; one key-custody failure is a multi-chain failure. Attribution to Lazarus rests on on-chain links to Stake.com proceeds, not on a government finding.

Summary

CoinEx, a Hong Kong-based cryptocurrency exchange founded in 2017, suffered a coordinated hot-wallet compromise on 2023-09-12. CoinEx noticed anomalous withdrawals from several hot wallet addresses; preliminarily it attributed them to leaked hot-wallet private keys [securityweekcoinex]. Assets were drained on Ether, Tron and Matic and other chains [riskybizcoinex].

The loss was about $53-54M according to tracking firms [securityweekcoinex] [riskybizcoinex]. The multi-chain pattern is consistent with leaked keys controlling hot wallets on several networks.

CoinEx moved remaining hot-wallet assets to cold storage, suspended all deposits and withdrawals, shut down the hot-wallet server, began rebuilding the wallet system, and published suspicious addresses asking projects and exchanges to help freeze funds [securityweekcoinex]. The cited source does not say whether CoinEx would reimburse users.

Timeline (UTC)

When Event OAK ref
2023-09-12 Anomalous withdrawals from several hot-wallet addresses; about $53-54M drained across chains [riskybizcoinex] [securityweekcoinex] T11.001 (provisional; cause is leaked hot-wallet keys)
2023-09-12 to 14 CoinEx moves remaining assets to cold storage, suspends deposits/withdrawals, publishes suspicious addresses [securityweekcoinex] (defender response)
2023-09 ZachXBT and CertiK link stolen funds to addresses tied to Stake.com proceeds [riskybizcoinex] (attribution signal)

Realised extraction

About $53-54M across multiple chains; suspected OAK-G01. Recovery status not established in the cited sources.

Multi-chain extraction as structural signature

The comparison below is an analytic framing, not established by the cited sources:

  • 2017-2019 wave (Yapizon, Bithumb, Upbit): single-chain or single-network extraction (Bitcoin-dominant in 2017; Ethereum-dominant by 2019). Exchange signing infrastructure was chain-isolated; the attacker had to compromise per-chain signing surfaces.
  • 2022+ wave (CoinEx, Stake.com, BingX): multi-chain simultaneous extraction. The cited sources show a single hot-wallet key leak affecting several chains; claims about pre-positioned access are unverified.

The CoinEx case is the reference for the multi-chain extraction sub-pattern within T11.001.

Public references

Techniques demonstrated (2)