Bitcoin DeFi application Alex Lab attributes $4 million exploit to North Korea's Lazarus Group

Bitcoin DeFi protocol Alex Lab said the $4 million exploit it encountered last month was most likely linked to the Lazarus Group, a North Korea-backed cyber-hacking entity.

Alex Lab said in an X post on Tuesday that, after extensive investigations facilitated by crypto sleuth ZachXBT, the project has identified “substantial transaction evidence linking the attack to the Lazarus Group, a notorious hacker collective believed to be associated with the North Korean government.”

The team detailed in the post two addresses — an initial exploit link and an address connected to the Lazarus Group — which it said were “crucial” in tracing the flow of stolen assets. “We are actively collaborating with international law enforcement and cybersecurity experts to address the implications of this attack and to recover lost assets,” Alex Lab said.

On May 16, Alex Lab announced on X that it suffered an exploit using compromised private keys obtained via a phishing attack. “The exploiter was able to drain some assets from the ALEX protocol,” the project said at the time. Certik said the attack had resulted in about $4.3 million in losses.

Since then, the project said it has facilitated contact between Singaporean police and relevant crypto exchanges to ensure the security of stolen assets as the investigation proceeds.

“Many of those STX that we traced to CEXs are currently frozen with the relevant exchanges indicating that they will continue to freeze stolen assets pending the police investigations,” Alex Lab said in a separate post on Tuesday. “The Foundation will make appropriate announcement as soon as these frozen funds can be returned to the affected users.”

The price of the Alex token traded down 3.2% over the past 24 hours at the time of publication, according to CoinGecko data .