Phemex (2025) — Crypto Hack
LaunderedSingapore-based crypto exchange Phemex lost ~$70M when attackers compromised its hot wallet infrastructure across Ethereum and Solana.
Summary
Singapore-based crypto exchange Phemex lost ~$70M when attackers compromised its hot wallet infrastructure across Ethereum and Solana.
How It Was Compromised — CEX via Private Key Compromise / Hot Wallet Breach
On January 23, 2025, Phemex, a Singapore-based cryptocurrency exchange, was exploited for approximately $70M. The attacker compromised the exchange's hot wallet infrastructure, draining funds across Ethereum and Solana. The exploit was detected quickly, and Phemex suspended withdrawals while it investigated the incident. The exchange's cold wallets were not affected. Phemex later announced that it had identified the root cause as a compromise of the hot wallet's signing infrastructure and engaged with blockchain analytics firms and law enforcement to track and recover the stolen funds.
Fund Flow & Laundering Analysis
Stolen ETH and SOL were moved through multiple intermediary wallets on the respective chains. The ETH was deposited into Tornado Cash, while the SOL was moved through multiple intermediary wallets and bridged to other chains. The attacker used a complex network of intermediary wallets to fragment the laundering trail. Phemex offered a 10% bounty for the return of the funds.