1
Published signals
currently linked to this company
Company intelligence
Phemex cybersecurity incidents and threat signals
phemex.com
This company page brings together public reporting currently associated with Phemex. It reflects signals published by Shadow Tier and should not be read as a complete incident history.
Company links
0
Last 28 days
recent published signals
0
Last 90 days
recent published signals
1
High or critical
confidence classifications
July 22, 2026
Latest report
most recent published signal
Company signals
All published signals involving Phemex
Phemex Crypto Exchange Suffers $85 Million Hot Wallet Breach
On January 23, 2025, at 11:30 UTC, the Phemex crypto exchange detected unusual activity in its hot wallet, leading to a security breach where hackers stole over $85 million worth of cryptocurrency. The initial estimate of stolen crypto was $29 million, which later increased to $69 million by crypto security firm PeckShield, and finally to at least $85 million according to MetaMask's Taylor Monahan. Phemex's CEO, Federico Variola, stated that only hot wallets were impacted, while cold wallets remained secure. The exchange immediately suspended deposits and withdrawals and published proof of reserves. Phemex has since implemented a new, more secure system monitored by its cybersecurity partner, and withdrawals are being gradually restored. Users are advised not to use old deposit addresses and to contact customer support for any pending transactions. The threat actors remain unidentified, though such large-scale crypto heists are often attributed to groups like North Korea's Lazarus group.
FAQ
Questions about Phemex cybersecurity reporting
What does the Phemex page include?
It combines a reviewed organization profile with all current published Shadow Tier signals explicitly linked to Phemex.
Does every mention of Phemex appear here?
No. A signal must contain a reliable company connection and meet the publication criteria; incidental or ambiguous mentions are excluded.
Why can the incident count change?
The page follows current published reporting. Counts change as new evidence is added, classifications are reviewed, or older signals leave the reporting window.