On Thursday, reports emerged indicating that the cryptocurrency exchange Phemex fell prey to a significant exploit, resulting in the theft of millions in digital assets. The breach compromised hot wallets containing an assortment of cryptocurrencies, including USDT, USDC, and Ethereum (ETH), forcing the platform to temporarily suspend half of its withdrawal operations.
Phemex Experiences Its First Crypto Exchange Breach of 2025
Thursday morning marked the first major hack within the crypto exchange sector for the year. Reports surfaced detailing unusual activity linked to Phemex’s hot wallets across various blockchain networks.
Blockchain security firm Cyvvers announced on social media that they had detected several transactions directed towards questionable wallets across multiple chains, such as BNB, ETH, OP, POL, BASE, and ARB.
Initially, Cyvvers estimated that more than $29 million in cryptocurrency had been transferred to these unauthorized addresses. Subsequent analysis revealed that the impact extended to BTC and TRON blockchains, with total losses now approximating $37 million, according to updates from the firm.
Cyvvers reportedly identified about 125 suspicious transactions spanning different blockchains, noting that the attackers had begun converting the stolen tokens into Ethereum (ETH) to evade possible freezing measures.
On the other hand, on-chain analytics firm Lookonchain dissected the breach and reported that approximately $31 million was stolen in digital assets. Their breakdown revealed that the exchange’s hot wallet was drained of 3.48 million USDC, 3.42 million USDT, and 841 ETH, totaling $2.7 million.
The attackers also managed to acquire 110,701 LINK, 142 billion PEPE, 1.19 million FET, and 29,509 AVAX, collectively valued at around $7.3 million. Furthermore, Lookonchain identified additional assets like ONDO, TRX, CRV, JASMY, AAVE, SHIB, GRT, and BRETT among the stolen items.
Plans for User Compensation are Underway
In response to the incident, Phemex CEO Federico Variola confirmed the breach of one of the exchange’s hot wallets. He reassured users that the exchange’s cold wallets remained secure and that a thorough investigation was in progress.
Subsequently, the exchange announced on social media the temporary suspension of withdrawals as part of an emergency security review, although further details surrounding the incident were not disclosed.
In the interest of security, we are temporarily halting withdrawals while we conduct an emergency review and bolster wallet protections. We regret any inconvenience this may cause and assure our users that services will resume shortly. Phemex and our development team sincerely apologize for the disruption, and we remain committed to providing a reliable trading environment.
Nevertheless, the communication indicated that all other business functions were operational, and trading services continued without interruption. The Phemex team also announced that they are formulating a compensation strategy, which they plan to disclose in the near future.
It is important to highlight that in 2024, the prevalence of hacks and the total value lost within the crypto space rose compared to previous years. Data from Chainalysis indicates that 2024 marked the fourth consecutive year in which the total funds stolen through hacks surpassed the billion-dollar threshold.
Moreover, last year saw the grand total of stolen assets climbing to $2.2 billion, solidifying its place as the year with the highest number of individual hacks at 303 incidents by December.
Centralized exchanges (CEXs) emerged as the primary targets during Q2 and Q3, experiencing some of the largest breaches in the history of the industry. Conversely, Decentralized Finance (DeFi) platforms accounted for the largest portion of stolen assets during Q1, maintaining this trend for most quarters between 2021 and 2023.
