A recent security breach at Bitcoin DeFi protocol Alex Lab appears to have spilled into traditional banking, with Chinese outlet ChainCatcher reporting that customers of Shanghai Pudong Development Bank (SPD Bank) were among those affected.
The incident follows a major exploit on June 6, 2025, that Unchained says cost Alex Lab about $8.3 million in digital assets. Stacks-based tokens and stablecoins taken in that attack included roughly 8.4 million STX, 21.85 sBTC and several hundred thousand dollars’ worth of USDT, USDC and wBTC. Alex Lab has pledged to “fully reimburse affected users,” saying it will cover losses from its treasury while coordinating with law enforcement and exchanges to trace the funds.
Security firm Halborn pinpointed a fundamental vulnerability behind the June breach: the protocol’s self-listing verification logic failed to detect failed transactions on the Stacks blockchain, enabling the exploit. This was not Alex Lab’s first major incident. In 2024, an attack on its cross-chain bridge, XLink, drained more than $4 million; investigators later linked that operation to North Korea’s Lazarus Group, according to a detailed report cited by Coinfomania.
Concerns about cross-domain laundering are reinforced by a joint dossier from Japan’s Ministry of Foreign Affairs. The report names “Alex Lab (based in Singapore)” and major Chinese lenders, including Shanghai Pudong Development Bank, as entities targeted or compromised by DPRK-linked advanced persistent threat clusters such as Kimsuky and TraderTraitor. That document suggests North Korean cyber actors have increasingly used multi-stage workflows that blend DeFi exploits with attacks on traditional financial institutions to launder proceeds.
The convergence of DeFi hacks and traditional banking contagion has regulators and market participants on high alert. Observers will be watching whether Alex Lab can restore trust through stronger security and whether Chinese authorities move to protect banks and customers from further spillover from digital-asset incidents.
Read more AI-generated news on: undefined/news
