BitMEX Uncovers Lazarus Group Crypto Phishing Attack, Exposes Hacker IP and Security Flaws

BitMEX’s security team identified and foiled a sophisticated phishing attack led by the notorious North Korean hacking collective, Lazarus Group. Attackers targeted BitMEX staff with cleverly disguised collaboration offers regarding a Web3 NFT platform, attempting to lure them into visiting a GitHub project containing malware. The malware aimed to collect user data, storing it in a public Supabase database. Due to an operational oversight and a misconfigured VPN, the attacker exposed their real IP address—traced to Jiaxing, China and linked to an operator dubbed ’Victor.’ BitMEX tracked nearly 900 logged incidents and monitored the attacker’s activity patterns, including VPN usage. The firm has developed a monitoring tool and released indicators of compromise (IoCs) to bolster industry awareness and defensive measures. The incident highlights persistent threats from state-sponsored hackers to crypto exchanges and traders. Broader market trends noted include stablecoins leaving Binance, long-term holders reducing positions, and large entities selling as smaller wallets accumulate—conditions that signal heightened cybersecurity risk, increased market caution, and potential price consolidation for major cryptocurrencies like Bitcoin and Ethereum.