# Phemex 

Date:: 2025-01-23

Amount Stolen:: $85,085,704

Tags:: 👛 TraderTraitor

---

## Details

The Singapore-based Phemex cryptocurrency exchange's hot wallets were hacked, resulting in a loss of approximately $70 million.

Word on the street is they got onto a random lower-level employee and pivoted in Slack to find the devop guys

Fast forward many attempts, many days, many hours, and docker-compose finally ran and that was the end of that.


## Further Reading

- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34

- https://rekt.news/phemex-rekt/

- https://x.com/Federico0x/status/1882411493280649237

- https://x.com/Federico0x/status/1882492744410492947

- https://x.com/Federico0x/status/1882700089807765668

- https://x.com/Federico0x/status/1882790130743697433

- https://x.com/CyversAlerts/status/1882407857447997803

- https://x.com/Phemex_official/status/1882417902038749317

- https://x.com/CryptooAdy/status/1882754717530607909

- https://x.com/hackenclub/status/1882416215186104730

- https://www.theblock.co/post/336754/north-korea-hack-group-possibly-behind-70-million-phemex-exploit-experts-say

- https://www.web3isgoinggreat.com/?id=phemex-hack

- Attributed in [MSMT: The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities](./pdfs/2025-10-22_MSMT-Report.pdf)



## Onchain - Initial Theft

| Address                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Chain    | Amount       | Value           | Time                        |               |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ------------ | --------------- | --------------------------- | ------------- |
| 3q38w9HpZcVGrKp43WSJa6KQpEfSDSoAyaebuARwbU8B <br> CSERJWB57xayQte4xyngoUVPDcWwJgXX9V4NjPS19F66                                                                                                                                                                                                                                                                                                                                                                                             | solana   | 68,476.60    | $16,872,528     | @ 11:48 Jan 23              | T + 0 hours   |
| 0x5b34414e95a8b8d0b16a39baf5b97cec1d517e22 <br> 0x56c199ea0968e206c89194da204099132234d929 <br> 0x7f4fc4408c4b4ee0bb228c2d7ed1e8f9ef30ce34 <br> 0x86fa29a99df0c7d24635ea9fe304e19a50e0dbc9 <br> 0x069987773b3dee7ac4affb9f06a4a90f9984ab10 <br> 0x17bcc630b1409637d42dfb278f8e2ea9fc862631 <br> 0x6c42f03d730b7643939fa1d00416cb2985ed9cf3 <br> 0xe9aa4a999ca1d9093054cf4f5dc221a06d433650 <br> 0xeba89b66c132e7fad2a238bf416fb9d45dcad1ff <br> 0x140dea3b704d724ddff41597b35a10ce0189661f | eth      | 6,328.47     | $21,058,531     | @ 11:49 Jan 23              | T + 0 hours   |
| TBz3DH6GUpg4cEGrcKzs8gSTvLQCGaYk5F <br> TLz7tV8B4hAwYZ54ES1HQfRrdi8SFfxbA1                                                                                                                                                                                                                                                                                                                                                                                                                 | tron     | 7,235,688.19 | $1,833,108      | @ 11:49 Jan 23              | T + 0 hours   |
| rGSu6JJ9dLZ3mpfGhtFczNjZjgoHEJcHgf                                                                                                                                                                                                                                                                                                                                                                                                                                                         | xrp      | 4,252,168.89 | $13,484,960     | @ 11:49 Jan 23              | T + 0 hours   |
| PU4WSJFPJF6E33LZ5FECO3I3GTYPB6Z3NBGNW7ERZGMPVEPFQW4E2YMRFU                                                                                                                                                                                                                                                                                                                                                                                                                                 | algo     | 2,875,740    | $1,150,370      | @ 11:49 Jan 23              | T + 0 hours   |
| 0x6c42f03d730b7643939fa1d00416cb2985ed9cf3 <br> 0xd760CC6F2D41E43309912D54a0955dbC8A77890f                                                                                                                                                                                                                                                                                                                                                                                                 | bsc      | 4,793.12     | $3,321,699      | @ 11:51 Jan 23              | T + 0 hours   |
| 0x392d99ec0348172c046cd64b85c21df0927ab946 <br> 0x870d65b3908A5213180550089eD1671A2d1E4af0                                                                                                                                                                                                                                                                                                                                                                                                 | base     | 592.278217   | $1,913,616      | @ 11:52 Jan 23              | T + 0 hours   |
| 0x069987773b3dee7ac4affb9f06a4a90f9984ab10 <br> 0xae2f4172f3665c0aa332e871b32314d26d47f465                                                                                                                                                                                                                                                                                                                                                                                                 | arbitrum | 305.260375   | $986,278        | @ 11:59 Jan 23              | T + 0 hours   |
| 0x17bcc630b1409637d42dfb278f8e2ea9fc862631 <br> 0x7288ca84ab40be3435dd33d0ceac57fe75eccd1d                                                                                                                                                                                                                                                                                                                                                                                                 | avax     | 29,508.76    | $1,090,389      | @ 12:01 Jan 23              | T + 0 hours   |
| bc1q7v5se5aq37g3lw8ccgre2laktpt6qrjvxqcz4p                                                                                                                                                                                                                                                                                                                                                                                                                                                 | bitcoin  | 50.657       | $5,379,896      | @ 12:02 Jan 23              | T + 0 hours   |
| 0x4eff816c3fe9bd163d223546ef60020f0162ab4206339a0f14bdb60b639f0794 <br> 0xcfcefe62850aabe2c2ed2f22078ad092e1f79575f42b997dee5d161dfb21ea9c                                                                                                                                                                                                                                                                                                                                                 | sui      | 687,038      | $2,887,539      | @ 12:03 Jan 23              | T + 0 hours   |
| LU6ddXsXxwmojJkU29wu5AS67tpD3GQiXc                                                                                                                                                                                                                                                                                                                                                                                                                                                         | ltc      | 10,135.12    | $1,204,711      | @ 12:05 Jan 23              | T + 0 hours   |
| 0xf493033b14ce39cbc6a283921ea50919c5d43dfe <br> 0x9B52594bFe50c51A75a8775ea03aD687E25E6A58                                                                                                                                                                                                                                                                                                                                                                                                 | polygon  | 1,552,183.40 | $703,501        | @ 12:05 Jan 23              | T + 0 hours   |
| DCvPsn3KQzJzgJ5yfnMqrXkfLnWv5Mvi5F                                                                                                                                                                                                                                                                                                                                                                                                                                                         | doge     | 10465847.9   | $3,624,276      | @ 12:17 Jan 23              | T + 0.5 hours |
| 0xeba89b66c132e7fad2a238bf416fb9d45dcad1ff <br> 0xB66aF6Fe0478507f2cF74F43a2bc383fdcF8d09c                                                                                                                                                                                                                                                                                                                                                                                                 | zksync   | 85.71330021  | $279,772        | @ 12:41 Jan 23              | T + 0.5 hours |
| 1xjLtr1PTVi4hkSkG81HEf4mVpq9FRyEAQunGiBjQJ2VvLq <br> 139PZAjWoAHxjh6gAzrqnoQN9bniSELHXh3xzabXqho6eciP                                                                                                                                                                                                                                                                                                                                                                                      | dot      | 151,138.03   | $956,017        | @ 12:41 Jan 23              | T + 0.5 hours |
| 0xe9aa4a999ca1d9093054cf4f5dc221a06d433650 <br> 0xa90209B59a78f6100Bb18882baBA2AdF9F57Ab34                                                                                                                                                                                                                                                                                                                                                                                                 | optimism | 153.666545   | $496,569        | @ 12:48 Jan 23              | T + 1 hours   |
| 0x521ca0920fe5f77c63cb4e6aa9567a0c460c1b26                                                                                                                                                                                                                                                                                                                                                                                                                                                 | xdc      | 3,240,255.10 | $415,465        | @ 12:59 Jan 23              | T + 1 hours   |
| GCX7AQYXMNNDC4YRR4MPMSJ23KU7ZJ3EOBS2QJDPALQHJDJGYRTFK432                                                                                                                                                                                                                                                                                                                                                                                                                                   | xlm      | 1,957,944.86 | $865,078        | @ 13:48 Jan 23              | T + 2 hours   |
| 0xa12a5e80f19332759bd7bfa3f5505ca2c7d1dee7 <br> 0xe79f52dcc0c1375a5112d32f3aa40115d4311ca9                                                                                                                                                                                                                                                                                                                                                                                                 | eth      |              | $23,000         | @ 14:17 Jan 23              | T + 2.5 hours |
| f1ewajq4cw3rjzzpvwkkrnn3j7xlvuece4t5ez37q                                                                                                                                                                                                                                                                                                                                                                                                                                                  | filecoin | 97,299.60    | $486,498        | @ 14:40 Jan 23              | T + 3 hours   |
| cosmos1sr7lxvfm0a2pfjv8gt7jy6df2k7jyas6jl2ksq                                                                                                                                                                                                                                                                                                                                                                                                                                              | cosmos   | 27,577       | $164,623        | @ 15:11 Jan 23              | T + 3 hours   |
| t1fhmRhP1HrD8PnSUzpCK578YGLfh9Gms4L                                                                                                                                                                                                                                                                                                                                                                                                                                                        | zcash    | 3,830        | $183,797        | @ 15:43 Jan 23              | T + 4 hours   |
| 0xd30dc7fb42a7054cbe8b140bd038498e9ba562eb                                                                                                                                                                                                                                                                                                                                                                                                                                                 | etc      | 5,008.09     | $137,341        | @ 17:03 Jan 23              | T + 5 hours   |
| tz1NWRQ8Ps369H1E28J5A67HEWcgVRkFTYfn <br> tz1WyPed25WRdessWkVSDkuJgivcu3E12ndL                                                                                                                                                                                                                                                                                                                                                                                                             | tezos    | 86325.0649   | $101,093        | @ 17:10 Jan 23              | T + 5 hours   |
| qz62nkswtf5v0kytwujajq6pw98pymqxssnht3r50f                                                                                                                                                                                                                                                                                                                                                                                                                                                 | bch      | 273.499856   | $117,803        | @ 17:11 Jan 23              | T + 5 hours   |
| TSQdeYZyuzRykZLnsTRW4A89BXvMaKbhsp                                                                                                                                                                                                                                                                                                                                                                                                                                                         | trx      |              | $81,000         | @ 17:14 Jan 23              | T + 5 hours   |
| XnH1LZugZHhqMn3JgLjM7mJwVScyTmArnh                                                                                                                                                                                                                                                                                                                                                                                                                                                         | dash     | 2,005.34     | $70,276         | @ 18:40 Jan 23              | T + 6 hours   |
| addr1q8st8zg9ynw995zqtlrfuajw6vua49m9depzzf8ed7zah3hqkwys2fxu2tgyqh7xnemya5eem2tk2mjzyyj0jmu9m0rqtwuq0c                                                                                                                                                                                                                                                                                                                                                                                    | ada      | 2,542,014.77 | $2,470,274      | @ 18:51 Jan 23              | T + 7 hours   |
| 0.0.8154399 <br> 0.0.8163960                                                                                                                                                                                                                                                                                                                                                                                                                                                               | hedera   | 6,393,378    | $2,131,025      | @ 19:01 Jan 23              | T + 7 hours   |
| 0x90cc88937d8885e3be414e083372eb17cb85bc94                                                                                                                                                                                                                                                                                                                                                                                                                                                 | eth      |              | $21,000         | @ 19:21 Jan 23              | T + 7 hours   |
| UQBMwzh34D70qj_nEzB2jkX_hdRhEI68LJSa6pww7eQmBBRB <br> UQCwH0gq9fOGklHDC5Dr8VY9_YgBe_-AJvhxbqAtyxoUJaQi                                                                                                                                                                                                                                                                                                                                                                                     | ton      | 128925.7242  | $654 671.93     | @ 13:39 Jan 24              | T + 26 hours  |
|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |          |              |                 |                             |               |
|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |          |              | **total**       | **could have been rescued** |               |
|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |          |              | **$84,512,032** | **$7,268,273**              |               |



## Onchain - Various Phemex-controlled Addresses



| Address                                                    | Chain       | Notes            |
| ---------------------------------------------------------- | ----------- | ---------------- |
| 3PiGxVdpMjWSsH8X8BypdwcsmPW5cmE4Ta                         | BTC         | Phemex Cold      |
| 0xf7D13C7dBec85ff86Ee815f6dCbb3DEDAc78ca49                 | ETH         | Phemex Cold      |
| 0xf7D13C7dBec85ff86Ee815f6dCbb3DEDAc78ca49                 | ETH TOKENS  | Phemex Cold      |
| TM7rxykbNRuFd2iZ1zVH4P8xrpSCduw9vD                         | TRX         | Phemex Cold      |
| TM7rxykbNRuFd2iZ1zVH4P8xrpSCduw9vD                         | TRX TOKENS  | Phemex Cold      |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | ARBITRUM    | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | AVAX        | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | BASE        | Phemex Gas Giver |
| 0xfe065653cff3154f44ed30ee876570e49051a6e8                 | BASE        | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | BLAST       | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | BSC         | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | CELO        | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | ETH         | Phemex Gas Giver |
| 0xfe065653cff3154f44ed30ee876570e49051a6e8                 | ETH         | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | FANTOM      | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | LINEA       | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | Moonriver   | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | OPTIMISM    | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | POLYGON     | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | SCROLL      | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | TAIKO       | Phemex Gas Giver |
| 0x2710EB8B7f29def9Fc856c87Aeb64d05d068DA3A                 | ZKSYNC      | Phemex Gas Giver |
| addr1v8hhy20gp9fm0769ajlzg5untmfddqy9ak5u5nytr2xtguchjnwp0 | ADA         | Phemex Hot        |
| GVDYDJGOJRRUPDNTUOIZ7CNTMRMC33LY2ULRQBWBTSJSURXHEXIJHO5NHU | ALGORAND    | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | ARBITRUM    | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | AVAX        | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | BASE        | Phemex Hot        |
| qr057zsy6xhn5puu7kymhu80ka0tz2lha58djpdpap                 | BCH         | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | BLAST       | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | BSC         | Phemex Hot        |
| bc1q32sxnq5hecdurfzgzp5x0zh8du86v9x84wdqdx                 | BTC         | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | CELO        | Phemex Hot        |
| cosmos1vfq5qfnefwpsarsqnlas9894rrm5rm095xm99z              | COSMOS      | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | CRONOS      | Phemex Hot        |
| Xw1TakcVnYXjQsi2fJgo8QRt4UcVfMXPQM                         | DASH        | Phemex Hot        |
| DDF87yUT8FLEXDuRi4BpVn2rNcvQjdR8JC                         | DOGE        | Phemex Hot        |
| phemexprdv21                                               | EOS         | Phemex Hot        |
| 0x42984ce6ba186fd684c92ed3165fa029be2f217e                 | ETC         | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | ETH         | Phemex Hot        |
| f16o24ornzrfuhdpivbcm43fzem2uum35ycp7dlyy                  | filecoin    | Phemex Hot        |
| 0.0.5791784                                                | HEDERA      | Phemex Hot        |
| inj1tsd9wr07r74ws9zdjkpdtl9m44f9qng086sqev                 | INJ         | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | LINEA       | Phemex Hot        |
| ltc1qqxaw8550zsyurqe6p8v9lyn3t883x27u7q4m89                | LTC         | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | Moonriver   | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | Optimism    | Phemex Hot        |
| 15hTaSogYFyGyRJhXdpQWRR1J9oya5nj4nFppi4XgUVMCvmP           | POLKADOT    | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | Polygon     | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | Scroll      | Phemex Hot        |
| EWSHJzKpzjpwz9GuNKkXWMHXAiwtB7obSGhdFKu5QZku               | SOLANA      | Phemex Hot        |
| 0x50be13b54f3eebbe415d20250598d81280e56772                 | TAIKO       | Phemex Hot        |
| tz1Rwf9herudqoEDSYXDCT4Urf9iEhE6uX92                       | TEZOS       | Phemex Hot        |
| UQD4z9HR6C0sSLI001VLFIGqGMzEmRbNE5b_Gr_PuPXi7tzY           | TON         | Phemex Hot        |
| TApjGv6mbzPaX7BTHTQmgLLiVdzdxsNRxE                         | TRX         | Phemex Hot        |
| THAABzWrhp84Nr7gxss7qhtzA5mp3d1qUo                         | TRX         | Phemex Hot        |
| GDPKBXKNPZYU3TH2WCM7DFA2LBX76MJMRYT6BAIO7ZL6KYD2WVBXCYE6   | XLM         | Phemex Hot        |
| rQKKvBvEfXbTThkqrtqaY3sAKuW6iqcMzX                         | XRP         | Phemex Hot        |
| t1c8KB1JCzp7duNdtedEDjNTPSCSn24h6Mz                        | ZEC         | Phemex Hot        |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | ARBITRUM    | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | AVAX        | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | BASE        | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | BLAST       | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | BSC         | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Celo        | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Cronos      | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | ETH         | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | ETH STABLES | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | ETH TOKENS  | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Fantom      | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Linea       | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Mantle      | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Moonriver   | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Optimism    | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Polygon     | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | Scroll      | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | TAIKO       | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | XDC         | Phemex New       |
| 0xdb861e302ef7b7578a448e951aede06302936c28                 | ZKSYNC      | Phemex New       |
| 3J7oUWf9zHZMmhwKJYiCvKdtNCp4TEV3X9                         | BTC         | Phemex??         |




## Connections

Major MAJOR overlaps in malware between Phemex and [Bybit](./bybit.md)