GDAC Incident Analysis

## Executive Summary On 8–10 April GDAC, a South Korean cryptocurrency exchange, experienced a likely private-key compromise that resulted in the loss of approximately $13 million (about 23% of the exchange's holdings). Stolen assets were moved from compromised EOAs on Ethereum and largely from a WEMIX wallet, with portions swapped and deposited to Tornado Cash; CertiK provides transaction flows, impacted addresses, and notes this as the largest private-key compromise they detected in 2023 while comparing broader private-key compromise trends.