Hackers steal $70m from Phemex in 2025’s largest attack so far

Singapore-headquartered crypto exchange Phemex is investigating a $70 million hot wallet exploit as hackers continue to siphon funds into Ethereum wallets.

Blockchain analytics firm PeckShield reported that Phemex lost $69.1 million in a Jan. 23 exploit targeting the exchange’s hot wallets, marking what appears to be the largest crypto hack of 2025 so far. In a Jan. 24 post on X, PeckShield revealed that the hack impacted wallets across multiple blockchains, including Ethereum (ETH), Solana (SOL), XRP (XRP), and Bitcoin (BTC).

According to Hacken analysts, the unidentified hackers, believed to have ties to North Korea, moved quickly to convert stolen Tether (USDT) and USD Coin (USDC) stablecoins into ETH, aiming to “bypass blacklisting risks.”

On Ethereum alone, approximately $20 million worth of assets, including ETH and stablecoins, were drained. Solana accounted for $17 million in losses, followed by $13 million in XRP and $5.3 million in Bitcoin, according to PeckShield’s breakdown as of Jan. 24.

“Cold wallets remain safe”

Phemex CEO Federico Variola reassured users that the exchange’s cold wallets “remain safe.” He later revealed that USDT and USDC withdrawals “are being progressively restored.”

“All requests will be manually reviewed by our security team, so please be patient with the queue time,” Variola said in a Jan. 24 X post. Variola added that Bitcoin wallets were not impacted and withdrawals for BTC “will be enabled soon.”

Details of how the exploit occurred remain unclear. Phemex has stated it is working on a “compensation plan, which will be announced soon.” The hack surpasses the $21 million FortuneWheel exploit on BNB Chain earlier this year, making it the largest crypto hack of 2025 to date, according to De.Fi data.