ZachXBT Reacts to CoinEx’s Shutdown And Why It Differs From BitMart’s Exit

I don’t think I’ve ever seen a compliment and a complaint delivered in the same breath quite as bluntly as ZachXBT managed this week.

Right after CoinEx announced it was closing down and returning every dollar of user funds, one of crypto’s most respected on-chain investigators showed up to say, essentially, good for you for actually doing the right thing and then spent the rest of his post reminding everyone why he still doesn’t trust the team that ran the place. It’s a strange kind of send-off, and I think it says as much about CoinEx’s history as the shutdown notice itself does.

A Backhanded Compliment From Crypto’s Most Feared Investigator

ZachXBT built his reputation by tracing stolen crypto back to the people who stole it, which means when he says a company deserves credit, that’s not a small thing. In his response to CoinEx’s shutdown announcement, he opened by acknowledging that CoinEx returning user assets and maintaining solvency puts it ahead of exchanges like AscendEX and BitMart, both of which left users dealing with frozen funds, stalled withdrawals, or outright losses during their own exits.

I think that comparison matters more than it might look at first. ZachXBT isn’t someone who hands out praise casually, and putting CoinEx above two exchanges whose shutdowns turned genuinely messy is about as close to a compliment as he tends to give.

What ZachXBT Actually Said About CoinEx’s Wind-Down

But the praise didn’t last long. In the same post, ZachXBT pivoted straight into a grievance he’s apparently been sitting on for years. He said that after CoinEx was exploited by the Lazarus Group, he tried reporting that the hackers’ own stolen funds were being laundered back through CoinEx’s platform and received zero response.

He added that he’d also frozen funds tied to the exploit himself and never got a reply for that either, closing with a blunt assessment that the team working under CoinEx’s leadership was, in his words, useless. I read that less as an attack on the shutdown decision itself and more as ZachXBT making sure that the goodwill CoinEx is earning now doesn’t erase what he sees as a real failure years earlier, at the exact moment it mattered most.

The 2023 Lazarus Group Hack He’s Still Not Over

To understand why this stings for him specifically, I think it helps to go back to what actually happened. In September 2023, CoinEx was drained of at least $55 million in an attack that blockchain security firm SlowMist and ZachXBT both attributed to North Korea’s Lazarus Group. CoinEx first flagged the incident after noticing large outflows to an address with no prior transaction history on September 12, with early loss estimates around $27 million before SlowMist’s figures climbed past $55 million as the investigation continued.

CoinEx responded publicly at the time by freezing deposits and withdrawals, promising affected users full compensation, and committing to a detailed incident report. From what I can tell, the exchange did follow through on the compensation piece, which is presumably part of why ZachXBT still credits them with solvency today.

How Investigators Traced The Attack Back To North Korea

What made the Lazarus Group’s involvement provable rather than speculative was a mistake on their own end. According to ZachXBT’s original reporting from that time, the hackers accidentally reused the same wallet address across multiple attacks, connecting the CoinEx exploit directly to the $41 million hack on the crypto gambling platform Stake, which the FBI had already formally attributed to Lazarus Group just days earlier.

That kind of address reuse is a genuine investigative gift, it’s the digital equivalent of leaving a signature at two different crime scenes. It’s part of why ZachXBT’s attribution work carries so much weight in this industry, and it’s exactly the skill set he was apparently trying to put to use again when he reported the laundering activity flowing back through CoinEx after the fact.

Why Unanswered Reports Still Sting Years Later

What I keep coming back to is the specific nature of his complaint. He’s not just saying CoinEx got hacked, which happens to plenty of exchanges through no real fault of their own. He’s saying he handed them actionable intelligence, that stolen funds were being laundered back through their own platform and that CoinEx apparently didn’t respond, even as he took the extra step of freezing funds tied to the exploit on his own initiative. If that account is accurate, it represents exactly the kind of institutional silence that erodes trust in an industry that depends heavily on researchers like ZachXBT volunteering their time to chase down stolen money. I think that’s why he felt the need to say it now, publicly, attached to a shutdown announcement that might otherwise let that particular failure quietly fade into the background of an otherwise dignified exit.

What This Exchange Says About CoinEx’s Legacy

Taken together, I think ZachXBT’s reaction captures something that a straightforward shutdown notice never could, that an exchange can do the right thing at the end and still have unresolved history that doesn’t just disappear because the ending was handled well. CoinEx is closing with its reserves intact and its users getting paid back in full, which genuinely puts it ahead of several peers that failed at exactly that task. But ZachXBT’s post is a reminder that the same team getting credit for an honest exit is the one he says went quiet during the exchange’s worst moment three years ago. Both things can be true at once, and I think that’s exactly the point he was making.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. Follow us on X @nulltxnews