Cryptocurrency payment processor Alphapo suffered a devastating hot wallet breach on July 22, 2023, with on-chain investigators initially reporting losses exceeding $23 million before the figure was revised upward to approximately $60 million — and possibly as high as $110 million as forensic analysis deepened. The attack, widely attributed to North Korea’s Lazarus Group, stands as one of the most significant centralized crypto infrastructure compromises of mid-2023.
The Exploit Mechanics
The attack vector centered on Alphapo’s hot wallets — internet-connected wallets maintained by the Curaçao-based payment gateway to facilitate real-time transaction processing. On-chain analyst ZachXBT first flagged the breach on July 23, revealing that stolen funds from Ethereum-based wallets were being systematically swapped for ETH before being bridged across to the Avalanche and Bitcoin blockchains.
On the Ethereum network alone, the attackers siphoned approximately $101 million in various tokens: 2,490 ETH (roughly $4.7 million), 6.07 million USDT, 108,050 USDC, 1,687 DAI, 100.2 million FTN (Fasttoken, valued at approximately $91.9 million), and 430,080 TFL tokens. All stablecoins were promptly converted to an additional 3,252 ETH. The combined 5,716 ETH — worth roughly $10.5 million at the time — was then distributed across 67 newly created Ethereum addresses before being bridged to Bitcoin.
Simultaneously, the attackers accessed Alphapo’s Tron hot wallet, extracting over 118 million TRX tokens worth approximately $9.5 million. Blockchain intelligence firm Blockchain Intelligence Group traced the stolen TRX to an address previously linked to the Atomic Wallet hack, further reinforcing the Lazarus Group connection.
Affected Systems
Alphapo, established in 2018, operates as a crypto payment gateway serving over 100,000 users with instant transactions across more than 30 digital assets. The platform is particularly prominent in the online gambling sector, providing payment infrastructure for major platforms including HypeDrop, Ignition, and Bovada.
HypeDrop, one of Alphapo’s most visible clients, immediately disabled withdrawals in response to the breach and issued a public statement: “Our provider is currently working to solve some recent issues from their side. They are facing problems specifically related to withdrawals of BTC, ETH, and TRX, as well as deposits for ETH and TRX.” The disruption extended across Alphapo’s entire service network, affecting both deposit and withdrawal functionality for multiple cryptocurrency pairs.
The breach also impacted CoinsPaid, a related crypto payment platform that lost $37.3 million in a separate but similarly executed Lazarus Group attack on the same date, suggesting a coordinated campaign against centralized payment infrastructure.
The Mitigation Strategy
Following the breach, the attackers employed a sophisticated laundering pipeline. Stolen funds were converted to ETH, bridged across multiple blockchains including Avalanche and Bitcoin, and ultimately deposited into Sinbad — a cryptocurrency mixer previously associated with Lazarus Group operations. The use of cross-chain bridges to obfuscate fund trails has become a hallmark of state-sponsored crypto theft, creating significant challenges for blockchain forensic investigators.
For affected platforms and users, the immediate mitigation involved halting all withdrawal and deposit operations for impacted assets. HypeDrop assured customers that remaining funds were safe, though the full extent of user exposure remained unclear as the investigation progressed. The incident underscored the critical importance of separating hot wallet operations from cold storage reserves, with the majority of platform assets ideally maintained in air-gapped cold wallets.
Lessons Learned
The Alphapo breach highlights several persistent vulnerabilities in centralized crypto payment infrastructure. Hot wallets, by design, require internet connectivity for real-time transaction processing, making them inherently susceptible to remote attacks. The Lazarus Group’s repeated success against similar targets — including the Atomic Wallet hack, the CoinsPaid breach, and the subsequent Stake.com heist — demonstrates a systematic campaign targeting payment processors with inadequate access controls.
Key takeaways from the incident include the necessity of multi-signature authorization for hot wallet operations, real-time transaction monitoring with automated anomaly detection, and strict limits on the percentage of total platform assets maintained in hot wallets at any given time.
User Action Required
Users of platforms that relied on Alphapo’s payment infrastructure should monitor official communications from their respective services for updates on withdrawal restoration. Those who held funds on affected platforms during the breach period should document their balances and transaction histories. Additionally, the broader crypto community should remain vigilant against phishing attempts exploiting the breach narrative, as attackers frequently leverage high-profile incidents to distribute malware through fraudulent compensation or refund schemes. With Bitcoin trading at approximately $30,084 and Ethereum at $1,889 at the time of the incident, the stolen assets represented significant purchasing power that is unlikely to be recovered.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
$23M became $60M became possibly $110M. The forensic accounting on these Lazarus hacks keeps getting worse as investigators dig deeper.
ZachXBT is doing more on-chain forensics than most three-letter agencies. The ETH to Avalanche to BTC laundering path is textbook Lazarus.
Nkem ZachXBT flagged it within hours of the first transfers. meanwhile actual regulators took weeks to even acknowledge it happened
Erik D. zachxbt flagged it within hours while actual regulators took weeks. on chain sleuths are the only real defense against lazarus now
100.2M FTN tokens stolen and that alone was worth $91.9M at the time. one token almost the entire hack
100.2m FTN tokens worth 91.9m from one breach. a single token made up most of the losses. that kind of concentration risk is insane for a payment processor
Curacao-based payment processor, minimal regulatory oversight, massive hot wallets. This was always going to happen.
^ exactly this. jurisdiction shopping for crypto businesses is a security risk for everyone
Ingrid the jurisdiction shopping point is underrated. Curaçao, Seychelles, BVI… pick your favorite regulatory void and set up shop