The attack on crypto exchange CoinEx, which drained at least $55 million, was carried out by the North Korean hacker group Lazarus, according to blockchain security firm SlowMist and on-chain investigator ZachXBT. The hacker group was identified after it inadvertently exposed its address, which was the same one used in the recent Stake and Optimism hacks.
On Sept. 12, CoinEx saw large outflows of funds to an address without any prior history. Security experts immediately suspected that the exchange was breached, with initial estimates reaching approximately $27 million. At the time of writing, security firm SlowMist noted that the losses from the exploit had reached more than $55 million.