Previously, as reported by WikiBit, CoinEx exchange fell victim to a theft, resulting in the loss of a staggering $54 million.
https://www.wikibit.com/en/202309139084547370.html
CoinEx has now disclosed the third batch of addresses related to the hacker. Additionally, they are earnestly requesting assistance from relevant project teams and institutions to aid in the freezing and recovery efforts.
According to statistics from MistTrack, it appears that more of the stolen funds have been consolidated, causing the balance related to the hacker's addresses in the CoinEx theft to increase from $53.97 million to $55.57 million.
During their analysis, SlowMist has made the following findings:
The known Alphapo Exploiter (TDrs…WVjr) utilized TransitSwap to convert TRX to ETH and then cross-chain to the address (0x22be3b0a943b1bc0ea3aec2cb3ef511f3920a98d). As a result, this address has been marked as an Alphapo Exploiter on the ETH blockchain as well.
The hacker's address, 0x22be3b0a943b1bc0ea3aec2cb3ef511f3920a98d, is labeled as an Alphapo Exploiter on the ETH blockchain and as a Stake.com Exploiter on the BSC blockchain, indicating that this address is a shared address.
Address 0x75497999432B8701330fB68058bd21918C02Ac59 is marked as a CoinEx Exploiter on the ARB and OP blockchains and as a Stake.com Exploiter on the Polygon blockchain. This suggests that this address is a shared address.
Due to the FBI's association of the Stake.com Exploiter with the North Korean hacking group Lazarus Group, it is plausible that the Alphapo Exploiter, Stake.com Exploiter, and CoinEx Exploiter are all connected to the Lazarus Group, a North Korean hacking organization.