Lazarus Group compromised DragonEx infrastructure through phishing attacks using a fake Worldbit-bot trading software, obtaining private keys and API access to drain 20 cryptocurrency wallets including 135 BTC, 2,738 ETH, and other assets.

DragonEx announced the news on its official Telegram channel on Monday, stating that, on Sunday, March 24, it had suffered a cyberattack that saw cryptocurrency funds owned by users and the exchange “transferred and stolen.” In updates on the hack today, DragonEx’s Telegram admin provided wallet addresses for 20 cryptocurrencies to which the stolen funds had apparently been transferred. The list included the top five cryptos by market capitalization: bitcoin (BTC), ether (ETH), XRP, litecoin (LTC) and EOS, as well as the tether stablecoin (USDT) for which six destination addresses were provided.