The cryptocurrency world started 2025 with a stark reminder that even well-established exchanges remain vulnerable to sophisticated attacks. Singapore-based crypto exchange Phemex suffered a devastating breach that saw over $70 million in digital assets drained from its hot wallets across multiple blockchains. The incident, which came to light in mid-January, has been linked by security experts to North Korea’s notorious Lazarus Group, underscoring the persistent threat posed by state-sponsored hacking operations.
The Exploit Mechanics
The Phemex hack was not a simple private key compromise. According to analysis by security researchers, the attackers executed a highly coordinated operation that involved draining a wide array of assets across multiple blockchains simultaneously. The stolen funds included various ERC-20 tokens, native assets, and wrapped tokens that were swiftly converted into ETH and BTC to obscure their trail.
What made this attack particularly notable was the manual execution of numerous transactions across various chains. Security analyst Taylor Monahan from MetaMask noted that the complexity of the operation points to experienced threat actors rather than opportunistic hackers. The attackers demonstrated an intimate understanding of cross-chain asset conversion, moving quickly to consolidate stolen funds into the most liquid and difficult-to-trace assets available. At the time of the attack, Bitcoin was trading around $101,000 and Ethereum near $3,200, meaning the $70 million haul represented a significant but not catastrophic amount relative to the exchange’s total holdings.
Affected Systems
The breach primarily impacted Phemex’s hot wallet infrastructure, the component of an exchange’s storage system that remains connected to the internet to facilitate real-time trading. Hot wallets, by their very nature, carry inherent risks because they require internet connectivity to process withdrawals and deposits. The attackers exploited vulnerabilities in this connected infrastructure to gain unauthorized access to private signing keys.
The attack affected users holding assets across Ethereum, Tron, and several other blockchain networks. Phemex’s cold storage reserves, which hold the vast majority of customer funds, reportedly remained untouched during the incident. The exchange confirmed that it would compensate affected users from its own insurance fund, a promise that many in the community viewed cautiously given the track record of similar pledges from other compromised platforms.
The Mitigation Strategy
In the immediate aftermath, Phemex suspended all withdrawals and deposits while conducting a thorough security audit. The exchange engaged external security firms to investigate the breach and assess the full extent of the damage. Blockchain analytics firms, including Chainalysis and Elliptic, were enlisted to trace the movement of stolen funds and potentially identify the perpetrators.
The suspected link to North Korea’s Lazarus Group adds a geopolitical dimension to the incident. This group has been responsible for some of the largest cryptocurrency heists in history, using increasingly sophisticated techniques to launder stolen digital assets through mixing services and cross-chain bridges. The Phemex attack follows a familiar pattern seen in previous Lazarus operations: rapid multi-chain asset conversion, use of decentralized exchanges for swapping, and routing through privacy-focused protocols.
Lessons Learned
The Phemex incident reinforces several critical security lessons for the crypto industry. First, hot wallet security remains the weakest link in exchange infrastructure. Despite advances in multi-signature technology and hardware security modules, the fundamental tension between accessibility and security continues to create exploitable gaps. Second, the sophistication of state-sponsored attacks means that even well-funded exchanges may not have the resources to defend against nation-state-level threats without external support.
Third, the speed at which the attackers moved to convert assets highlights the importance of real-time monitoring and automated alerting systems. Exchanges must invest in anomaly detection that can flag unusual withdrawal patterns within seconds, not hours. The window for freezing stolen funds before they enter the broader DeFi ecosystem is extremely narrow, often measured in minutes rather than hours.
User Action Required
For Phemex users and the broader crypto community, this incident serves as a reminder to practice vigilant account security. Enable two-factor authentication using hardware keys rather than SMS-based methods. Distribute assets across multiple platforms rather than concentrating holdings on a single exchange. Consider moving long-term holdings to personal cold storage wallets where you control the private keys. Monitor exchange communications closely during and after security incidents, and verify information through independent sources rather than relying solely on official statements. The crypto market’s maturation does not eliminate risk — it transforms it, and users must evolve their security practices accordingly.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
70m across multiple chains in one go and they still had funds in hot wallets? at some point exchanges gotta accept that hot wallets are just Targets with a neon sign
rekt_journal exactly. multi-chain hot wallets in 2025 is just asking for it. cold storage with time-locked withdrawals should be the standard
70M across multiple chains in one coordinated strike. how are exchanges still keeping this much in hot wallets in 2025 honestly
hot_wallet_rant 70M drained in jan 2025 and exchanges still keep millions in hot wallets. lazarus has been doing this since 2017, theres no excuse anymore
Lazarus Group strikes again. The FBI linked them to $1.7B in crypto thefts by end of 2024. Phemex is just the latest entry in a very long list.
the manual tx execution part is what gets me. these arent script kiddies running automated scripts, this is a full time operation with shift workers basically
Taylor Monahan noting the manual tx execution is the scary part. these are trained operators working shifts, not automated scripts. state sponsored crypto theft at scale
Stefan M. the $1.7B number is probably low. a lot of hacks never get definitively attributed. the real figure could be double
Lazarus using manual tx execution means they have actual operations staff. state sponsored crypto theft is a whole industry now
Nina Okafor shift workers is exactly right. unit 180 of the RGB has dedicated crypto theft teams. this is nation state level operations not some hackers in a basement
converting stolen assets to ETH and BTC immediately is classic Lazarus laundering. chainalysis can trace it but recovering anything is a different story
cold_wallet_only chainalysis can trace but the manual tx execution means they already have the laundering playbook memorized. north korea has been doing this since 2017
Lazarus Group manually executing transactions across multiple chains for the Phemex hack. when a nation-state APT wants your keys, no multisig setup is bulletproof
Taylor Monahan flagging the manual complexity is what separates good chain analysts from great ones. automated tx patterns are easy to freeze. human operators adapting in real time are nearly impossible to stop
Phemex losing 70M across multiple chains simultaneously and converting to ETH and BTC on the fly shows next level laundering sophistication. Lazarus ops teams are better trained than most CEX security teams
multichain_drain_ having the private keys already means the breach was days or weeks before the drain. Phemex probably had compromised infrastructure and did not know it
multichain_drain_ the fact they hit multiple hot wallets at the same time means they had the private keys already. the breach happened way before the drain
hot_wallet_requiem_ having the private keys already means Phemex infrastructure was compromised for days before the actual drain. the real breach probably happened in early January and nobody noticed
Taylor Monahan pointing out the manual complexity is important. this wasnt an exploit script, it was trained operators moving fast across chains. different threat model entirely
Taylor Monahan flagging the manual execution across chains is an important detail. this wasnt a script, it was humans making real time decisions. much harder to trace or stop
Min-su P. manual execution across chains is the real tell. Lazarus runs these like military operations with trained staff on shifts. no automated script would adapt that fast
Caspian D. manual execution across chains is exactly how military operations work. shift workers, real-time decisions, adaptive laundering. no automated script evades chainalysis like a human does
70M drained across multiple chains simultaneously. hitting ERC-20 tokens native assets and wrapped tokens at the same time requires intimate knowledge of the hot wallet layout
hot_wallet_forensic_ Taylor Monahan noting the manual execution was key. Lazarus operators making real-time decisions across chains, not some script running on autopilot
converting stolen assets to ETH and BTC immediately. the laundering pipeline was ready before the attack. this was months of planning not opportunistic