The week of September 14, 2023, will be remembered as one of the most damaging stretches for cryptocurrency security in recent memory. Within days, three major incidents — the Vitalik Buterin SIM swap attack, the Remitano hot wallet breach, and the CoinEx hack attributed to North Korean operators — collectively drained tens of millions of dollars from the ecosystem. Bitcoin traded at approximately $26,540 while Ethereum hovered around $1,627, masking the turbulence unfolding behind the scenes.
The Exploit Mechanics
The attacks relied on fundamentally different vectors but shared a common theme: exploiting trust. On September 9, Ethereum co-founder Vitalik Buterin had his X (formerly Twitter) account compromised through a SIM swapping attack. The attacker social-engineered T-Mobile into transferring Buterin’s phone number to a device under their control, bypassing SMS-based two-factor authentication. The compromised account then posted a fraudulent NFT minting link that directed followers to a phishing site. Users who connected their wallets lost a combined $700,000 in cryptocurrency and non-fungible tokens.
Days later, on September 14, peer-to-peer exchange Remitano discovered that its hot wallets on both the Ethereum and TRON blockchains had been drained of approximately $2.7 million. The breach originated from a compromised private key, reportedly exposed through a third-party data leak. The attacker moved swiftly, siphoning 1,359,253 USDT, 208,188 USDC, 34.4 ETH, and 104,360 ANKR tokens on Ethereum, along with 537,915 USDT and 3,750,700 TRX on TRON.
The CoinEx hack, initially reported at $27 million but later revised to approximately $55 million, followed a similar playbook: compromised hot wallet private keys. Blockchain investigator ZachXBT linked the CoinEx attack to the same Lazarus Group wallets used in the Stake.com heist, which the FBI attributed to North Korean state-sponsored actors.
Affected Systems
The scope of these attacks was staggering. Buterin’s SIM swap affected individual users who trusted his account — Ethereum’s most prominent public figure. The Remitano breach impacted a peer-to-peer exchange serving users across multiple developing nations. CoinEx, a Hong Kong-based exchange, saw its entire hot wallet infrastructure compromised, forcing a complete suspension of deposits and withdrawals.
On the Ethereum blockchain alone, the Remitano attacker moved funds through address 0x74530e81e9f4715c720b6b237f682cd0e298b66c, converting stolen USDC and ANKR to 163 ETH before transferring proceeds to HitBTC. Tether’s rapid response team froze approximately $1.4 million in USDT on the attacker’s TRON address, preventing further losses but highlighting the centralized counterparty risk inherent in stablecoins.
The Mitigation Strategy
Tether’s intervention in the Remitano case demonstrated the value of rapid response protocols. By freezing the attacker’s addresses within hours, approximately $1.9 million in USDT was preserved. Remitano responded by suspending all deposits and withdrawals, migrating remaining user funds to cold wallets, deactivating old wallet addresses, and advising users to generate new deposit addresses.
For the Buterin SIM swap, the incident reignited discussions about eliminating SMS-based 2FA entirely. Buterin himself confirmed the attack vector and urged the community to adopt hardware security keys and passkeys instead of phone-based authentication. The attack exposed how even the most technically sophisticated individuals remain vulnerable to social engineering.
CoinEx took the drastic step of shutting down its entire hot wallet server infrastructure, transferring remaining assets to secure addresses, and engaging external security experts to conduct a full forensic investigation.
Lessons Learned
The convergence of these incidents underscores several critical lessons for the crypto industry. First, SMS-based two-factor authentication remains a fundamental vulnerability. Every exchange and high-profile individual should migrate to hardware security keys or time-based one-time passwords. Second, hot wallet private keys require the same level of protection as cold storage — multi-signature arrangements, hardware security modules, and strict access controls are non-negotiable.
Third, third-party data leaks can cascade into catastrophic breaches. Remitano’s compromise originated not from a direct attack but from sensitive data exposed through an external partner. Regular security audits should extend beyond internal systems to include all third-party integrations and vendors.
User Action Required
Individual users should immediately audit their own security practices. Disable SMS-based 2FA on all crypto-related accounts and replace it with authenticator apps or hardware keys. Verify that exchange accounts use unique, strong passwords not shared with any other service. Consider moving significant holdings to hardware wallets rather than keeping funds on exchanges, where hot wallet vulnerabilities remain an ever-present risk. The events of this week prove that no target is too prominent — or too small — for determined attackers.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
Three major attacks in one week and the market barely flinched. $26k BTC and everyone acts like this is normal.
had my number ported in 2022. took me 3 days to get it back. T-Mobile did not even flag it as suspicious. the telco security layer is a joke
simswap_survivor 3 days to recover your own number is insane. carriers should require in-person verification for any SIM swap but they wont because it adds friction
if VITALIK getting SIM swapped does not convince you to use a hardware key for 2FA nothing will
The CoinEx attribution to North Korean operators matches the pattern from the Treasury advisory. These are not random hackers, they are state-funded.
$55M from CoinEx, $700K from Vitaliks followers, $2.7M from Remitano. all preventable with basic opsec. the industry refuses to learn
^ this. and exchanges still use SMS 2FA in 2023. mind blowing
Vitalik getting SIM swapped and the industry collectively shrugged says everything about crypto opsec culture. if the creator of Ethereum gets hit nobody is safe