ChainCatcher news, cryptocurrency exchange CoinEx has announced that it has obtained a Virtual Asset Service Provider (VASP) license in Poland to prepare for the implementation of the EU MiCA regulations later this year. With the VASP license in Poland, CoinEx can enter other member states through the EU passport.

ChainCatcher news, cryptocurrency exchange CoinEx announced the launch of MUSIC and opened the MUSIC/USDT trading pair for trading. The deposit and withdrawal channels have been opened.

ChainCatcher news, the founder of the cryptocurrency exchange CoinEx, Yang Haipo, responded in the TG community regarding the issue of XDAG withdrawals not being reopened after the exchange was hacked. He stated that XDAG is quite special, as the amount of XDAG stolen by hackers accounts for a high proportion of the total circulation. The only solution is for the project team to retrieve the stolen tokens through a hard fork; until then, CoinEx cannot do anything.It is reported that XDAG is a token that uses CPU mining. In the CoinEx hot wallet private key leak incident, hackers stole over 229 million XDAG (worth 1.21 million USD), accounting for 18.7% of its total circulation.Previous report, on September 12, the cryptocurrency exchange CoinEx was attacked by hackers, and the leak of private keys led to the theft of tokens worth over 70 million USD. CoinEx officials stated that affected users would receive full compensation for all financial losses.

ChainCatcher message, according to CertiK monitoring, the CoinEx attacker (address starting with 0xc84) has transferred 14,900 BNB (approximately 3.1 million USD) to an EOA address starting with 0xCb8. This fund has been sent in small amounts to different wallets through an EOA address starting with 0x4cf.

ChainCatcher message, on-chain data shows that at 12:32 Beijing time, the CoinEx hacker transferred 5000 BNB (approximately 1 million USD) to the address 0xCb85...a914.

ChainCatcher news, according to Cointelegraph, blockchain security company Match Systems has discovered that a Telegram user is selling stolen cryptocurrency at a discount through peer-to-peer transfers, related to the recent hacks of CoinEx and Stake.Investigators successfully identified and contacted the individual offering the stolen assets on Telegram. The team confirmed that the user controlled an address containing over $6 million worth of cryptocurrency after receiving a small transaction from the corresponding address. The sale of the stolen assets was conducted through a specially created Telegram bot, which sold these assets at a 3% discount to market price; the initially offered assets have been sold, and new tokens will be available for sale in about three weeks.The Match Systems team was unable to fully identify the person's identity, but based on several screenshots and the timing of conversations they received, they narrowed down their location to the European time zone.

ChainCatcher news, according to monitoring by Shield, the CoinEx attacker holds approximately 137 million TRX (worth about 11.63 million USD), accounting for 0.1541% of the total supply of 8.9 billion. They are currently the 66th largest TRX holder.

ChainCatcher message, CoinEx announced on platform X that as of September 25, the deposit and withdrawal services for 346 cryptocurrencies have been restored. The team is establishing verification points and synchronizing across various public chains, and the recovery of the remaining cryptocurrencies will take more time.CoinEx emphasizes that for further updates regarding the restoration of deposits and withdrawals, please refer to the official fee standard page and social media channels. Only the cryptocurrencies specified in last week's announcement and the official fee standard page can be used for deposits and withdrawals; all other statements are scams.

ChainCatcher news, according to the official announcement, the cryptocurrency exchange CoinEx has now resumed the deposit and withdrawal services for cryptocurrencies. Users need to generate a new deposit address; sending assets to the old address will result in loss.

ChainCatcher message, CoinEx announced that it is expected to complete the reconstruction and deployment of its wallet system at 16:00 Beijing time on September 21, 2023, and restore the deposit and withdrawal services for Bitcoin, Ethereum, USDT (ERC-20, TRC-20), USDC (ERC-20), TRX, LTC, BCH, DOGE, SHIB, and BNB. CoinEx stated that new deposit addresses will be generated after the deposit and withdrawal services are restored.

ChainCatcher news, according to Cointelegraph, the cryptocurrency exchange CoinEx has disclosed the progress of a previous hacking incident, stating that the leak of private keys has led to hackers stealing tokens worth over $70 million. However, the exchange claims that this amount only accounts for a small portion of its total managed assets, and affected users will receive full compensation for all their losses.CoinEx stated that it is still investigating the identity of those responsible for the security breach, with some blockchain security companies believing that the attackers are the North Korean hackers Lazarus Group. Additionally, CoinEx has opened communication channels with the hackers "to reach a mutually agreed solution."

ChainCatcher message, CoinEx officials stated that 80% of the wallet system reconstruction work has been completed, and preparations for the withdrawal function are being initiated. Detailed information regarding the website upgrade and maintenance will be shared later today.

ChainCatcher message, CoinEx Global has updated the progress of the security incident on social media platforms. As of today, the team has successfully completed 50% of the wallet system reconstruction work. In addition, the team has identified a strategy for resuming withdrawals, which will be gradually restored within 7 working days. Ensuring 100% asset security remains the top priority before reactivating the withdrawal function. For certain low-circulation cryptocurrencies, the team is developing a compensation strategy.

ChainCatcher message, SlowMist's Chief Information Security Officer 23pds tweeted that SlowMist stated the $55 million hack suffered by the cryptocurrency exchange CoinEx was carried out by state-sponsored hackers from North Korea.

ChainCatcher news, CoinEx has updated the progress of the security incident on social platforms. The team is collaborating with a blockchain security company to actively track and identify the stolen funds and related hacker addresses, and has made significant progress. Currently, 30% of the wallet system reconstruction work has been completed. This comprehensive wallet system reconstruction covers 211 chains and 737 types of cryptocurrencies.According to previous news from ChainCatcher, on September 14, the cryptocurrency exchange platform CoinEx released an update on the hacking incident, stating that the preliminary determination is that the cause of the incident was the leakage of the hot wallet private keys. The investigation and handling work is proceeding in an orderly manner, and the assets in CoinEx's cold wallet have not been affected by this incident.

ChainCatcher news, according to monitoring by PeckShield, the attacker of the cryptocurrency exchange CoinEx transferred 113 ETH from Arbitrum to the Ethereum mainnet via Stargate, and then moved it to centralized exchanges such as Binance and FixedFloat.

ChainCatcher news, the cryptocurrency exchange CoinEx has announced the latest developments regarding the hacking incident, stating that the preliminary cause of the event is the leakage of hot wallet private keys. The attack mainly involved crypto assets such as BTC, ETH, XRP, BCH, and SOL, with the specific value still being settled. The assets in CoinEx's cold wallet were not affected by this incident. CoinEx promises that its user asset security foundation will cover the economic losses caused by this incident.Currently, CoinEx is working on rebuilding the wallet system, including 211 chains and 737 tokens. During this period, users are advised not to deposit to old addresses to avoid potential asset losses.

According to ChainCatcher news, Scopescan monitoring shows that the malicious attacker associated address starting with 0x6953, previously disclosed by the cryptocurrency trading platform CoinEx here, has exchanged all its FLOKI, BRG, TLM, BUGER, and other tokens for BNB, and transferred 29,552 BNB (approximately 6.2 million USD) to a dormant address starting with 0xc844.

ChainCatcher message, SlowMist found during the analysis of the CoinEx attack incident that the CoinEx hacker may be associated with the North Korean hacker group Lazarus Group, with specific connections as follows:The known Alphapo Exploiter (TDrs...WVjr) exchanged TRX for ETH through TransitSwap and cross-chained to the address (0x22be3b0a943b1bc0ea3aec2cb3ef511f3920a98d), thus this address is also marked as Alphapo Exploiter on Ethereum;The hacker address 0x22be3b0a943b1bc0ea3aec2cb3ef511f3920a98d is marked as Alphapo Exploiter on Ethereum and as Stake.com Exploiter on BNB Chain, indicating that this address is a shared address;0x75497999432B8701330fB68058bd21918C02Ac59 is marked as CoinEx Exploiter on Arbitrum and OP Mainnet, and as Stake.com Exploiter on Polygon, indicating that this address is a shared address.Since the Stake.com Exploiter has been linked by the FBI to the North Korean hacker group Lazarus Group, it is possible that the Alphapo Exploiter, Stake.com Exploiter, and CoinEx Exploiter are all part of the North Korean hacker group Lazarus Group.