Alex Lab, a Bitcoin-based DeFi protocol, disclosed new developments regarding the hack it experienced in May. The project announced that it has potentially identified the perpetrator with the assistance of a blockchain investigator, while law enforcement continues its investigation into the incident.

DeFi Protocol Faces Major Loss in Phishing Attack

On May 15, the Alex Lab Foundation fell victim to an exploit that resulted in the loss of millions in user funds. The DeFi protocol revealed that the attacker gained access to private keys through a phishing attack, thereby gaining control over the funds.

Using the compromised keys, the attacker accessed one of the vaults associated with the Alex Liquidity Pool, compromising all assets within that vault.

The affected assets included aBTC, sUSDT, XBTC, xUSD, ALEX, atALEX, LiSTX, SKO, CHAX, $B20, ORDG, ORMM, ORNJ, TRIO, TX20, and STXS. However, the project clarified that its underlying smart contract code and infrastructure were not compromised in the incident.

After assuming control, the attacker drained approximately 13.7 million Stacks (STX), with 3 million STX subsequently sent to various centralized exchanges (CEXs). According to reports, the exploiters transferred STX to exchanges such as Binance, Kraken, OKX, Bybit, Kucoin, and others.

DeFi

Summary of the stolen STX tokens. Source: Alex Lab on X

By May 16, the DeFi project had recovered most of the affected assets. It also disclosed that it was monitoring the wallets of the exploiters and had informed the involved CEXs.

Alex Lab also reported that approximately $4 million worth of stolen funds were in the process of being recovered from one of the centralized exchanges. However, the protocol cautioned that there was no guarantee that all stolen funds would be retrieved.

Lazarus Group Suspected In Attack

On June 17, Alex Lab provided an update on the incident, stating that efforts to contact the attacker had been unsuccessful, prompting continued tracking of the stolen assets.

During this ongoing investigation, the team discovered that the hacker had broadcasted nearly 10,000 transactions within a month. The attacker created hundreds of new addresses to distribute the on-chain STX tokens, sending them in smaller amounts to CEXs.

The number of wallets linked to the exploit continued to grow exponentially, with 8.3 million STX, valued at about $14 million, deposited to CEXs by last week. Approximately 5.5 million STX remained on-chain.

DeFi

Movement of the stolen STX tokens. Source: Alex Lab on X

On June 24, Alex Lab disclosed significant new findings in its investigation. According to the DeFi protocol, they had potentially identified the attackers.

Apparently, some of the addresses involved in the exploit were traced back to the Lazarus Group, a North Korean hacking group. Forensic analysis, aided by crypto investigator ZachXBT, revealed "significant transaction evidence linking the attack to the Lazarus Group."

The initial exploit address where the funds were sent originally transferred funds to a second address, which appeared to be associated with the Lazarus Group based on transaction history showing use of a known Lazarus TRON address.

Related Reading: Galaxy Digital Predicts Minimal Bitcoin Sell Pressure From Mt. Gox Resolution

The foundation stated it had facilitated communication between the CEXs and the Singapore Police Force. Additionally, they emphasized collaboration with cybersecurity experts to address the implications of the attack and work towards recovering the lost assets.