DragonEx Singapore Exchange Compromised by Lazarus Group — User Funds Stolen March 2019
ConstrainedCustodial platform became inaccessible — recovery ran through a lengthy institutional process.
DragonEx, a Singapore-based cryptocurrency exchange, suffered a critical security breach on March 24, 2019, when attackers gained access to internal systems and transferred both user deposits and the exchange's own reserve funds to external wallets. The exchange disclosed the incident publicly on March 25 via Telegram.
Subsequent investigation by law enforcement and cybersecurity analysts attributed the attack to North Korea's Lazarus Group, the same threat actor responsible for the 2014 Sony Pictures breach and the 2018 Binance hack. The attack vector was sophisticated: adversaries created a fake trading company with a convincing website and used LinkedIn and Telegram to distribute malware to DragonEx employees. This social engineering approach yielded access to critical infrastructure.
DragonEx immediately suspended all platform operations upon discovery. The exchange coordinated investigations with law enforcement agencies in Estonia, Thailand, Singapore, Hong Kong, and Mongolia—a sign of the geographic complexity inherent in tracing cross-border crypto theft. The total value of stolen assets was not initially disclosed in the announcement, creating additional uncertainty for affected users.
The exchange attempted to compensate users from remaining company reserves and instituted a gradual recovery process over subsequent months. However, the breach fundamentally damaged institutional trust and market participation. DragonEx resumed operations at severely reduced volume and never regained its pre-incident standing. For users, the incident crystallized the custody risk inherent in third-party exchange holdings: regardless of exchange operational competence, a single successful internal compromise could result in permanent asset loss, with compensation dependent on the exchange's remaining solvency and willingness to cover losses from capital reserves.
| Stress condition | Vendor lockout |
| Custody system | Exchange custody |
| Outcome | Constrained |
| Documentation | Present and interpretable |
| Year observed | 2019 |
| Country | Singapore |
Why custodial Bitcoin fails differently than self-custody
Exchange custody transfers the custody problem from the holder to the institution. The holder no longer needs to manage seed phrases, maintain hardware, or understand cryptographic concepts. They need only to maintain their account. This simplicity has a cost: the holder no longer controls the private keys. Access depends entirely on the continued operational, financial, and regulatory health of the exchange.
Cases in this archive show that exchange failures cluster around specific event types: bankruptcy and insolvency, regulatory seizure, geographic sanctions, and account-level access failures (lost 2FA, forgotten email credentials). Each event type has a different recovery path and a different timeline. Bankruptcy proceedings typically take 6-24 months and produce partial recovery. Regulatory seizure timelines depend on legal process. Account access failures may be resolvable through platform support or may not.
The distinguishing feature of vendor lockout cases is that recovery — when it occurs — happens through processes the holder did not design and cannot control. They become claimants in a process rather than holders of an asset.
The primary protection against vendor lockout is not using a vendor for custody beyond what is needed operationally. Holdings intended to be stored long-term are most exposed to institutional risk. Exchange custody is well-suited for active trading and conversion; it is poorly suited for long-term storage of significant value. Moving Bitcoin off exchange into self-custody eliminates platform dependency at the cost of taking on personal custody responsibility.
Translate