On September 12, 2023 at 17:18, Cyvers Alerts tweeted about suspicious withdrawals on the CoinEx Exchange. Crypto assets including ETH, TRON, MATIC and more were transferred from CoinEx’s hot wallets to unknown addresses, raising suspicion of a potential hack.
CoinEx team responded to the incident on Twitter at 20:21 on the same day. According to the official statement, the exchange’s risk control system detected abnormal withdrawals from various hot wallet addresses used to store CoinEx’s exchange assets.
The team responded immediately, setting up a special team to investigate the incident and promising 100% compensation for any losses resulting from this breach.
Urgent Notice: Security Incident on CoinEx – Immediate Actions Underway
On September 12, 2023, our Risk Control System detected anomalous withdrawals from several hot wallet addresses used to store CoinEx's exchange assets. Promptly recognizing the gravity of the situation, we…
— CoinEx Global (@coinexcom) September 12, 2023
As Bitcoinsistemi.com, we have contacted the CoinEx team for more details about the attack. They reported that the security team was tracking the stolen funds and making progress. On September 12 at 21:20, CoinEx revealed the first set of hacker wallet addresses on Twitter and asked various blockchain organizations for help in freezing them.
Suspicious addresses are listed below:
$ETH:
0xce013682eddefaca8c94fe56a43a04212ebe4673 0x8bf8cd7F001D0584F98F53a3d82eD0bA498cC3dE 0xCC1AE485b617c59a7c577C02cd07078a2bcCE454 0x 483D88278Cbc0C9105c4807d558E06782AEFf584
$BTC:
1BHNb9UJy4cWFB5wywZkTVgoNB4JbFmswH
$TRON:
TP75t6owoqXxskLq6FB2R37PymNTmohq9L TPFUjxQzG88Vwynrpj2W61ZAkQ9W2QYgAQ$XRP: rpQxVcjVF2fC23r3xKyJS53jw8d5SRhZQf
CoinEx announced the second set of hacker addresses detected on September 13 at 05:41:
$ETH:
0x2118e4432d668aCFa347ddBA0efCcc6BB04DB297 0x1A61Df134d766f1e240FBFAEe79bBeCC04195f62 0x40cBe7580168d52b7FEC884120B31115c3F7E37E
$XRP:
rpQxVcjVF2fC23r3xKyJS53jw8d5SRhZQf
$LEFT:
G3udanrxk8stVe8Se2zXmJ3QwU8GSFJMn28mTfn8t1kq
$BSC:
0x6953704e753C6FD70Eb6B083313089e4FC258A20
$KDA:
k:a9f3672d7ad7a1e4592702d73b220cbc61db1fa17f89a56131d965bc03959913
$BCH:
qrgxyhj8rzl4l7fgauu6q6vtu2grct4jeyrnaq2s75
$XDAG:
15VY3MadZvLpXhjzFXwCUmtZcHszju6L9
As of now, CoinEx has disclosed three sets of hacker addresses and requested relevant project teams and exchanges to monitor and freeze suspicious addresses.
Users are worried because they cannot withdraw money from CoinEx at the moment. Fortunately, the exchange assured them that, for the sake of asset security, withdrawals would resume once the hacker addresses were pinpointed and isolated after a “thorough investigation.” The team also underlined that user assets remain “safe and untouched.”
Unlike cold wallets, which are kept offline and therefore more secure, hot wallets are more vulnerable to attacks. The past few years have witnessed numerous exchange hacks and cryptocurrency thefts, which have dealt a heavy blow to blockchain security. Finding effective ways to keep hackers away remains a challenge for cryptocurrency exchanges.
As of this writing, CoinEx is still evaluating the losses incurred. Bitcoinsystem will continue to follow this situation closely and provide updated information as soon as possible.
