Atomic Wallet Hack — June 2023

Atomic Wallet is a non-custodial cryptocurrency wallet for desktop and mobile published by the Estonian company Atomic Solutions. Users hold their own private keys; the wallet provides UX, swap integration and multi-asset support.

Beginning around 2-3 June 2023, Atomic Wallet users began reporting unauthorised outbound transfers of their entire balances. By 5 June, on-chain analysis firm Elliptic estimated 5,500 affected wallets with combined losses near $100M in BTC, ETH, USDT and other tokens.

The technical vector has not been publicly established. Atomic Wallet's own incident report acknowledged the breach but described the cause as still under investigation. Independent researchers have proposed multiple hypotheses including compromise of the wallet's update mechanism, leak of mnemonic seeds through telemetry, and targeted client-side malware. Some affected users reported never having installed any other crypto software.

In April 2024 the Federal Bureau of Investigation jointly attributed the attack to North Korea's Lazarus Group, citing on-chain laundering patterns consistent with prior Lazarus exploits. As of writing, the Atomic Foundation has not announced direct compensation to affected users.