In a significant security breach, Singapore-based cryptocurrency exchange Phemex suffered a loss exceeding $70 million, marking the largest crypto hack of 2025 to date. The attack, which occurred on January 23, targeted the exchange’s hot wallets and affected multiple cryptocurrencies, including Ethereum (ETH), Solana (SOL), XRP, and Bitcoin (BTC).
Details of the breach
Blockchain security firm PeckShield reported that approximately $69.1 million was siphoned from Phemex’s hot wallets. The stolen assets were distributed across various blockchains, with losses of about $20 million in ETH and stablecoins on Ethereum, $17 million on Solana, $13 million in XRP, and $5.3 million in BTC.
Suspected perpetrators
Experts suggest that North Korean hacking groups may be responsible for the attack. The sophistication and methods used align with previous incidents attributed to North Korean state-sponsored hackers. Analysts noted that the attackers swiftly converted stolen Tether (USDT) and USD Coin (USDC) into ETH to mitigate the risk of asset blacklisting.
Phemex’s response
Phemex CEO Federico Variola assured users that the exchange’s cold wallets remain secure. He announced that withdrawals for USDT and USDC are being progressively restored, with all requests undergoing manual review by the security team. Variola also mentioned that BTC wallets were unaffected and that BTC withdrawals would be enabled soon. The exchange is currently developing a compensation plan for affected users, with details to be announced shortly.
Industry implications
This incident surpasses the $21 million FortuneWheel exploit on BNB Chain earlier this year, making it the most significant crypto hack of 2025 so far. It underscores the persistent vulnerabilities within the cryptocurrency industry and highlights the need for enhanced security measures to protect digital assets.
As the investigation continues, users are advised to monitor official communications from Phemex for updates and to exercise caution in managing their digital assets.
