Phemex

Documented events with consequences still open. Each entry carries a source and a date.

1. Jan 23, 2025 Hack / funds theft Critical $69M ● open

   Hot wallet keys compromised: sixteen hot wallets drained across sixteen blockchains in a matter of hours, withdrawals suspended for three days. Phemex has never published a figure of its own — independent estimates range from 29 to over 85 million dollars

   On **23 January 2025 at 11:30 UTC** Phemex detected «unusual activity» in its hot wallets. Those are the company's own words, from the official statement carrying the timeline (`phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timeline`). The attacker drained **sixteen hot wallets across sixteen different blockchains**, including Ethereum, Solana, XRP and Bitcoin, in a way the analyses describe as systematic: **highest-value tokens first, and immediate conversion of freezable assets into ones that cannot be frozen** — maximising the haul while minimising any chance of recovery. The cause given by **Halborn**'s analysis is **private key compromise**, most likely from centralised storage: it is the only hypothesis that explains why all sixteen wallets fell the same way. ⚠️ **The amount is the most delicate part of this entry and should be read for what it is.** Phemex has **never published a figure of its own**, neither then nor since. Every estimate comes from third parties and they rose over the days: **~29 million** in the first hours, **69.1 million** according to **PeckShield** (which on 24 January breaks it down as $17M on Solana, $13M in XRP, $5.3M in Bitcoin), **73 million** in Halborn's analysis, **at least 85 million** in the count by MetaMask's **Taylor Monahan**. `importo_usd` carries PeckShield's figure, as the measurement of an identified forensic party and the most widely cited one; the full range stays written here because a single number, on a fact where the company says nothing, would be false precision. **What Phemex did, with the dates from its own statement:** deposits and withdrawals suspended on almost all chains on **23 January at 15:13 UTC**; gradual reopening with manual approval from **24 January** (ETH, USDT and USDC on Ethereum), then **25 January** (Bitcoin, then SOL/USDC/USDT on Solana), then **26 January** (Arbitrum, Optimism, BSC, Polygon, Base); **all withdrawals restored by February 2025**. CEO **Federico Variola** publicly confirmed the episode, calling it «sophisticated», and stated that **cold wallets were not touched**. Phemex also did something rare in comparable cases: it **published a Proof of Reserves** right after the attack to show solvency, and in its statement writes that it has «sufficient asset reserves» and that «user funds are always safe». **Why `risolto` stays `false` on a twenty-month-old fact.** Not because the service is frozen — it has been fully operational since February 2025 — but because the three things that would close the case never arrived: **the funds were never recovered**, Phemex **committed** to reimbursing affected users without any public confirmation that reimbursements were completed (and a promise of reimbursement is not a reimbursement), and **there is no final accounting and no technical post-mortem** from the company. On attribution, finally, no confirmation: the analyses point to the North Korean **Lazarus** group based on the modus operandi, but that is an analysts' hypothesis, not an official attribution, and it stays one on this card. `in_corso` is `false`: nothing is happening right now.

   ↗ source

verified on Oct 2, 2026

Weighted average across 2 public review platforms (3,035 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.