How much was lost in the CoinEx hack?

$55M Stolen, as publicly reported (September 12, 2023).

Who was behind the CoinEx hack?

Publicly attributed to Lazarus Group 🇰🇵. ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/CoinEx

CoinEx Hack: $55M Stolen

Q: How was the CoinEx hack carried out?

Hot Wallet Drain. CoinEx hot wallets were emptied across 9+ chains in a coordinated key-compromise operation. On Ethereum the drain reached the address below, reported at 408,741 DAI from a CoinEx hot wallet; ChainHint's trace starts there.

September 12, 2023 · Ethereum · Lazarus Group 🇰🇵

stolen across chains

$55M

first drain transaction (reported)

408,741 DAI

addresses traced

292

transfers

1,484

What happened

On September 12, 2023, hot wallets of the CoinEx exchange were drained across nine-plus chains for roughly $55M — an operation attributed to North Korea's Lazarus Group. On Ethereum the flow ran through the address Etherscan labels "CoinEx Fund Drainer 2", from which ~6,558 ETH moved onward for laundering. ChainHint's trace follows the drainer as it fans the funds out through DEX swaps and ends at exchange deposit addresses among the terminals — custodial touchpoints where freeze requests are possible.

How the funds moved

Step 1

Hot Wallet Drain

CoinEx hot wallets were emptied across 9+ chains in a coordinated key-compromise operation. On Ethereum the drain reached the address below, reported at 408,741 DAI from a CoinEx hot wallet; ChainHint's trace starts there.

Step 2

ETH-side Consolidation

The "CoinEx Fund Drainer 2" address forwarded ~6,558 ETH onward. Sibling drainers (Etherscan's "Fund Drainer 3/4") handled smaller tranches in parallel.

Step 3

Swap-and-Scatter

Stolen tokens were swapped through Uniswap pools and scattered across dozens of fresh wallets. ChainHint's endpoint attribution peeked one hop beyond the unknown terminals and resolved exchange deposit addresses — the trail continues inside custodial services.

Where the funds went

Read from the transfers in ChainHint's trace, not from press reports

First transfer

Sep 12, 2023

Last transfer traced

Oct 7, 2026

Hops traced

DEX swaps

ChainHint's trace of the CoinEx hack follows 1,484 transfers across 292 addresses and 6 hops, between Sep 12, 2023 and Oct 7, 2026. 2 of the transfers are DEX swaps.

Visualized attack path

292 addresses · 1,484 transfers · Traced with ChainHint

View Interactive Graph →

Key findings

Primary ETH Drainer

0x8bf8…c3de"CoinEx Fund Drainer 2" — Etherscan-labeled drainer, the address this trace starts from. Attribution to Lazarus Group is consistent with cross-hack consolidation addresses tagged on Arbitrum and Optimism.

Lazarus GroupEtherscan-labeled

Custodial Touchpoint

Exchange deposit addresses identifiedChainHint's outbound-flow attribution resolved unknown terminals as exchange deposit addresses — funds crossed into custodial services where KYC records and freeze requests apply. The exchange labels behind them are unverified, so this page does not name them.

Freeze Possible

Multichain Scope

9+ chains drained simultaneouslyEthereum is one slice of the operation: BTC, TRON, Polygon and other chains were hit in the same window. The ETH-side graph shows the swap-and-scatter phase in full.

Investigate your own incident

ChainHint traced the CoinEx hack in minutes.
Use the same tool for your case.