Hot wallets across 11 chains drained by Lazarus.
Attacker wallets funded and staged ahead of the private key compromise exploit against CoinEx.
$70.0M drained from CoinEx on Ethereum via Private Key Compromise.
SlowMist flagged the anomalous transactions and published an initial alert.
CoinEx paused affected contracts or withdrawals and began tracing outbound flows.
Stolen assets followed through mixers, bridges, and exchange deposit addresses.
No assets recovered; losses absorbed by the protocol, insurers, or users.