The cryptocurrency payment processor CoinsPaid suffered a devastating security breach on July 22, 2023, losing $37.3 million to what investigators believe is the notorious Lazarus Group, a state-sponsored hacking collective tied to North Korea. The attack, which came to light as the crypto community was digesting the news on July 24, demonstrates that even well-funded platforms with sophisticated security infrastructure remain vulnerable to human-targeted attack vectors.
The Exploit Mechanics
Unlike typical DeFi exploits that target smart contract vulnerabilities or flash loan manipulation, the CoinsPaid attack relied on an extended social engineering campaign that spanned approximately six months. According to the company’s own incident report, the attackers made repeated failed attempts over half a year before finally breaching the infrastructure on July 22.
The Lazarus Group operatives initiated contact with CoinsPaid employees through carefully crafted communications, gradually building trust and establishing footholds within the organization’s operational workflows. The attackers leveraged a combination of spear-phishing emails, fabricated professional personas, and strategic manipulation to eventually gain access to critical systems controlling the platform’s hot wallets.
Once inside, the hackers executed a coordinated withdrawal of digital assets totaling $37.3 million. The stolen funds were quickly moved through a series of intermediary wallets, a hallmark of Lazarus Group operations that have been linked to billions in cumulative crypto thefts over recent years. Blockchain analytics firms tracked portions of the movement through mixing services designed to obscure transaction trails.
Affected Systems
CoinsPaid operates as a crypto payment gateway serving numerous online merchants and platforms. The breach specifically targeted the company’s operational infrastructure rather than individual user accounts. The platform confirmed that client funds processed through their payment channels were not directly affected by the breach.
Hot wallet systems, which maintain connectivity to the internet for real-time transaction processing, bore the brunt of the attack. The stolen assets included a mix of major cryptocurrencies, with Bitcoin trading around $29,176 and Ethereum near $1,850 at the time of the incident. Cold storage reserves, which hold the vast majority of client funds offline, remained secure throughout the event.
The breach underscored a broader vulnerability across the crypto industry: the intersection between human operators and automated systems. Even platforms with robust cryptographic protections can be compromised when attackers successfully manipulate the people who manage those systems.
The Mitigation Strategy
Following the breach, CoinsPaid implemented an emergency response protocol that included immediate suspension of certain processing operations, comprehensive security audits of all accessible systems, and engagement with blockchain analytics partners to trace the stolen funds. The company reported that it resumed normal processing operations after confirming the integrity of its remaining infrastructure.
Industry observers noted that the attack pattern aligns with Lazarus Group’s documented methodology. The FBI and various cybersecurity agencies have previously linked the group to attacks on Ronin Bridge ($625 million), Harmony Horizon ($100 million), and Nomad Bridge ($190 million), among others. The total damages from North Korean cyber operations targeting cryptocurrency platforms have reached an estimated $3.8 billion, according to blockchain analytics firm Chainalysis.
Lessons Learned
The CoinsPaid incident highlights several critical lessons for the cryptocurrency industry. First, social engineering remains the most effective attack vector against crypto platforms, often more successful than technical exploits. Second, the six-month persistence of the attackers demonstrates that state-sponsored groups invest significant time and resources into understanding their targets before striking.
Organizations must implement multi-layered security protocols that go beyond technical safeguards to include comprehensive employee training programs, strict access controls, and behavioral monitoring systems capable of detecting unusual patterns in internal communications and system access.
The incident also reinforces the importance of maintaining most assets in cold storage and implementing time-locked withdrawal mechanisms that provide sufficient delay for suspicious transactions to be flagged and reviewed before execution.
User Action Required
For users of crypto payment platforms, the CoinsPaid breach serves as a reminder to diversify holdings across multiple custodians, maintain personal cold storage for significant amounts, and monitor account activity regularly. Platforms that have undergone publicized security incidents often emerge stronger, but users should always verify that post-incident security improvements have been independently audited before increasing their exposure.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research before making decisions about cryptocurrency platforms.
six months of social engineering for $37.3M. Lazarus plays the long game, most crypto teams are not prepared for that level of persistence
chain_sentry 6 months of failed attempts before they got in. most security audits look at code, not at whether your employees can spot a fake linkedin recruiter
The fake recruiter angle is exactly how they hit Ronin too. Companies need actual security training, not just a compliance checkbox.
^ this. ronin bridge was literally the same playbook. when will teams learn that linkedin messages are not vetted
$37.3M from one payment processor and the industry barely blinked. We are so desensitized to these heists.
Tomoko I. $37.3M barely registers anymore. Ronin was $625M and people forgot in a month. the desensitization is real
fake recruiter angle is lazarus signature move. they hit ronin with it, now coinspaid. every crypto company should be training staff on social engineering specifically