ZachXBT Criticizes CoinEx for Security Lapses Amid Platform Liquidation

The prominent on-chain investigator ZachXBT has publicly criticized the cryptocurrency exchange CoinEx for its handling of a significant security breach linked to the Lazarus Group. According to the analyst, the exchange failed to respond to critical information regarding the laundering of stolen assets back through its own platform. This development coincides with the exchange's formal announcement to cease operations and begin an orderly liquidation process following the compromise of its hot wallets.

Communication Failures and On-Chain Findings

ZachXBT reported that despite attempts to assist the CoinEx team by identifying laundered funds, his efforts were met with silence. The detective alleged that the platform's own stolen liquidity was being cycled back through its systems, a common tactic used by hackers to obscure the trail of illicit proceeds. The Lazarus Group, a state-sponsored cybercriminal organization from North Korea, has been previously linked to numerous high-profile crypto exploits.

• Lack of response to external security reports.
• Ineffective monitoring of internal fund flows post-exploit.
• Failure to freeze accounts identified as associated with the attackers.

Official Shutdown and Withdrawal Deadlines

Following the security incident and subsequent pressure, CoinEx officially declared it would undergo orderly liquidation. The exchange has instructed its users to withdraw their remaining assets as the platform prepares to terminate all services. The timeline for the wind-down is strictly defined to ensure a controlled exit from the market.

CoinEx announced it would cease operations and undergo an orderly liquidation, with withdrawal channels open until December 22.

The exchange noted that December 22, 2026, serves as the final deadline for users to retrieve their holdings from the blockchain network. After this date, accessibility to funds may be significantly restricted or terminated entirely as the legal liquidation process concludes.

The incident highlights ongoing concerns regarding the security infrastructure of centralized exchanges and their ability to collaborate with independent researchers during crises. As CoinEx moves toward its final closure, the community remains focused on the recovery of assets and the transparency of the liquidation process. The situation underscores the risks associated with hot wallet management and the critical need for robust incident response protocols in the digital asset industry.