LCX disclosed a hot-wallet compromise and suspended account flows

The January 9 disclosure

On January 9, 2022, Liechtenstein-based crypto platform LCX said that one of its hot wallets had been compromised and suspended deposits and withdrawals while it investigated. A later court-filed copy of LCX’s public notices preserves the sequence: an initial service notice reported a security incident and the suspension, followed by an update confirming that Ethereum-based assets had been moved to an identified wallet without authorization.

The transfers themselves began late on January 8. One public Ethereum record shows 162 ETH moving from the address labeled “LCX 2” to the address LCX identified as the attacker’s wallet at 22:29:11 UTC on January 8. LCX’s subsequently expanded incident report places the transfer window between 11:23 p.m. and 11:37 p.m. Central European Time on January 8. Those timestamps are consistent within several minutes, but an explorer label is an attribution layer added by the service, not information encoded by Ethereum.

What was firmly knowable on January 9 was narrower than the eventual loss accounting. LCX had acknowledged unauthorized access to one connected wallet, named ETH, USDC, EURe and LCX among the affected assets, and halted customer funding movements. The platform did not establish a final dollar loss or publish a complete technical root-cause analysis in its first notices.

Why one hot wallet mattered

A hot wallet is kept online so an exchange can process customer deposits and withdrawals quickly. That availability also makes the wallet a distinct security boundary: control of its signing credentials can permit irreversible transfers even if an exchange’s databases, cold storage and other wallets remain intact. LCX’s suspension was therefore both a containment step and an operational disruption.

The incident also exposed the different control models bundled together under the phrase “crypto assets.” Ether transfers settle through Ethereum and cannot simply be reversed by an exchange. Some tokens, however, include issuer-controlled functions. LCX said it contacted Monerium after the breach and that approximately 611,000 EURe was disabled from further on-chain movement. That was a company claim on January 9, later reproduced in court papers; it did not mean every transferred asset could be frozen or recovered.

For the industry, the consequential point was not the size of LCX relative to larger venues. The compromise supplied a documented example of how a single online-wallet failure could interrupt a regulated-facing trading business, require coordination among an exchange, token issuer, analytics providers and other venues, and leave a trace that outside observers could inspect before investigators knew the operator of the receiving address.

What the record did not prove

The receiving address and transaction history established movement, timing and asset quantities. They did not identify the person controlling the address, establish the intrusion method, or prove that every later movement had the same controller. LCX’s statement that other wallets were unaffected was an issuer claim under an active investigation, not an independent audit conclusion. No verified market dataset establishes that the incident caused a move in bitcoin, ether or the broader market, so this reconstruction makes no price-causation claim.

Later context

LCX’s incident page, which was updated after January 9 and again through December 4, 2024, reports an approximate $7.94 million value using CoinGecko prices and says about $0.70 million was frozen. On January 10, 2022, LCX said it would use company funds so users would not bear losses. A New York court decision filed in August 2022 described approximately $8 million in Ethereum-based assets as having been taken. Those later records clarify scope and response; they are not presented as figures confirmed in LCX’s first January 9 notices.