CoinEx detected anomalous withdrawals from multiple exchange hot-wallet addresses on September 12, 2023 and suspended deposits and withdrawals while investigating unauthorized transactions involving assets including ETH, TRON, MATIC, BTC, XRP, BCH and SOL. SlowMist and later reporting attributed the theft to North Korea's Lazarus Group, while CertiK linked CoinEx to a broader 2023 Web3 breach cluster affecting Atomic Wallet, Alphapo, CoinsPaid and Stake through on-chain correlations across Ethereum and Tron infrastructure.