CryptoSlate reported that SlowMist attributed the CoinEx hot-wallet theft of more than $27 million to North Korea's Lazarus Group, with ZachXBT citing wallet links to the earlier Stake exploit on Optimism and Polygon. The source says SlowMist connected CoinEx addresses with wallets used in the Stake and Alphapo incidents, while the FBI had separately linked the $41 million Stake theft to North Korean state-backed actors. CoinEx had confirmed unusual withdrawals involving Ethereum, Tron, and ERC-20 assets, and investigators were tracking additional suspicious wallet addresses. The article frames the case as part of a wider pattern of North Korea-linked cryptocurrency theft used to raise funds despite sanctions.