northkoreahackers
113,346 views
95 Discussing
Hot
Latest
North Korea’s Lazarus Group Suspected In $30M Upbit Hack$BTC
$ETH
North Korea’s notorious Lazarus Group is suspected of stealing about $30.6 million from Upbit, the largest crypto exchange in South Korea.
That’s according to a Nov. 28 report by Yonhap News Agency that cited anonymous government and industry sources as saying they are increasingly confident the recent incident was orchestrated by the Lazarus Group, which has been linked to some of the biggest hacks in crypto’s history.
Upbit said it would reimburse customers whose assets were stolen in the incident using its own reserves. Trading activities on the platform are still active but investors are unable to add or remove assets from the platform until the investigation is completed.
The sources said the authorities are getting ready to perform an on-site inspection of Upbit.
News of the hack came shortly after Naver announced a $10.3 billion acquisition of Upbit’s parent, Dunamu, via an all-stock deal. #Upbit #NorthKoreaHackers #UpbitHack
$ETH
North Korea’s notorious Lazarus Group is suspected of stealing about $30.6 million from Upbit, the largest crypto exchange in South Korea.
That’s according to a Nov. 28 report by Yonhap News Agency that cited anonymous government and industry sources as saying they are increasingly confident the recent incident was orchestrated by the Lazarus Group, which has been linked to some of the biggest hacks in crypto’s history.
Upbit said it would reimburse customers whose assets were stolen in the incident using its own reserves. Trading activities on the platform are still active but investors are unable to add or remove assets from the platform until the investigation is completed.
The sources said the authorities are getting ready to perform an on-site inspection of Upbit.
News of the hack came shortly after Naver announced a $10.3 billion acquisition of Upbit’s parent, Dunamu, via an all-stock deal. #Upbit #NorthKoreaHackers #UpbitHack
See original
Upbit Exchange Hack: North Korean Hackers Back in the Game?
In November 2025, one of the largest cryptocurrency exchanges in South Korea, Upbit, became the victim of a massive cyberattack. Hackers stole cryptocurrency worth approximately 45 billion won (about 30 million USD), mainly in tokens based on Solana. This is not the first incident for the platform: in 2019, criminals stole 42 million dollars in Ethereum, and North Korean hackers were also suspected then.
**🚨 U.S. Targets Cambodian Company Aiding North Korea’s Crypto Crimes 💸**
The U.S. says Huione Group (Cambodia) helped North Korea’s hackers (Lazarus Group 👾) hide stolen crypto money. Quick facts:
- U.S. Move: Stop Huione from using U.S. banks 🏦 to block illegal crypto-to-cash schemes.
- $4 Billion Dirty Money :
→ 🐷 $36M from scams (people tricked into fake crypto deals).
→ 💻 $37M from North Korea’s stolen crypto.
- Secret Tool: Huione made USDH, a “stablecoin” tied to dollars that can’t be frozen 🚫, helping hide illegal cash.
- Cambodia Acted: Banned Huione’s crypto work in March 2024.
Why It’s Important: To stop bad actors like North Korea from using crypto for illegal funding 🌍.
Your thoughts? Should stablecoins be regulated harder? 👇
#crypto #NorthKoreaHackers
The U.S. says Huione Group (Cambodia) helped North Korea’s hackers (Lazarus Group 👾) hide stolen crypto money. Quick facts:
- U.S. Move: Stop Huione from using U.S. banks 🏦 to block illegal crypto-to-cash schemes.
- $4 Billion Dirty Money :
→ 🐷 $36M from scams (people tricked into fake crypto deals).
→ 💻 $37M from North Korea’s stolen crypto.
- Secret Tool: Huione made USDH, a “stablecoin” tied to dollars that can’t be frozen 🚫, helping hide illegal cash.
- Cambodia Acted: Banned Huione’s crypto work in March 2024.
Why It’s Important: To stop bad actors like North Korea from using crypto for illegal funding 🌍.
Your thoughts? Should stablecoins be regulated harder? 👇
#crypto #NorthKoreaHackers
North Korea’s 5,000-Ton Choe Hyon-Class Destroyer Sinks During Inauguration
North Korea's highly anticipated naval advancement turned into a national embarrassment as the new Choe Hyon-class destroyer capsized during its launch ceremony in front of Kim Jong Un. Designed as a symbol of rising maritime strength, the 5,000-ton warship never made it to sea. Reports suggest a critical failure in the launch mechanism caused the vessel to tip and sink.
Kim has condemned the incident as a “criminal act” and is reportedly furious with former Russian Defense Minister Sergei Shoigu, blaming Russian naval technology for the catastrophic failure.
North Korea's highly anticipated naval advancement turned into a national embarrassment as the new Choe Hyon-class destroyer capsized during its launch ceremony in front of Kim Jong Un. Designed as a symbol of rising maritime strength, the 5,000-ton warship never made it to sea. Reports suggest a critical failure in the launch mechanism caused the vessel to tip and sink.
Kim has condemned the incident as a “criminal act” and is reportedly furious with former Russian Defense Minister Sergei Shoigu, blaming Russian naval technology for the catastrophic failure.
North Korean Hackers Use Fake U.S. Firms to Target Crypto Devs
North Korean hacking groups have once again demonstrated how dangerously sophisticated they can be. This time, they’ve set their sights on crypto developers — posing as legitimate U.S.-based companies with one goal: to infect victims’ systems with malware.
🎭 Two Fake Companies. One Malicious Scheme.
Cybersecurity firm Silent Push has revealed that North Korean hackers created two LLCs — Blocknovas LLC in New Mexico and Softglide LLC in New York — pretending to be recruiters in the crypto industry. These companies sent “job offers” that contained malicious code. The notorious Lazarus Group, linked to North Korea’s intelligence services, is believed to be behind the operation.
A third entity, Angeloper Agency, showed the same digital fingerprint, though it wasn’t officially registered.
🧠 Malware That Steals Crypto Wallets
Once unsuspecting developers opened the infected files, the malware began harvesting login credentials, wallet keys, and other sensitive data. According to Silent Push’s report, multiple victims have already been identified — most linked to the Blocknovas domain, which was by far the most active.
The FBI has seized the domain and issued a warning that similar aliases may reappear soon.
💸 Covert Funding for North Korea’s Missile Program
According to U.S. officials, the ultimate goal of the scheme is simple: generate hard currency to fund North Korea’s nuclear weapons program. Intelligence sources say Pyongyang has been deploying thousands of IT operatives abroad to illegally raise funds through fraudulent schemes.
This case is especially troubling because it shows that North Korean hackers managed to set up legal companies inside the United States, a rare and alarming development.
🔐 Three Malware Families, One Lazarus Signature
Analysts found that the job files contained at least three known malware families, capable of opening backdoors, downloading additional malicious payloads, and stealing sensitive information. These tactics align closely with past attacks by the Lazarus Group.
⚠️ FBI Warning: Be Cautious of "Too Good to Be True" Job Offers
Federal agents emphasize that this case is a chilling reminder of how North Korea continues to evolve its cyber threats. Tech and cybersecurity professionals should thoroughly vet unsolicited job offers, especially those from unfamiliar companies. Developers infected by these schemes could lose cryptocurrency or unknowingly grant hackers access to larger systems and exchanges.
#HackerAlert , #CyberSecurity , #NorthKoreaHackers , #CryptoSecurity , #CryptoNewss
Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“
🎭 Two Fake Companies. One Malicious Scheme.
Cybersecurity firm Silent Push has revealed that North Korean hackers created two LLCs — Blocknovas LLC in New Mexico and Softglide LLC in New York — pretending to be recruiters in the crypto industry. These companies sent “job offers” that contained malicious code. The notorious Lazarus Group, linked to North Korea’s intelligence services, is believed to be behind the operation.
A third entity, Angeloper Agency, showed the same digital fingerprint, though it wasn’t officially registered.
🧠 Malware That Steals Crypto Wallets
Once unsuspecting developers opened the infected files, the malware began harvesting login credentials, wallet keys, and other sensitive data. According to Silent Push’s report, multiple victims have already been identified — most linked to the Blocknovas domain, which was by far the most active.
The FBI has seized the domain and issued a warning that similar aliases may reappear soon.
💸 Covert Funding for North Korea’s Missile Program
According to U.S. officials, the ultimate goal of the scheme is simple: generate hard currency to fund North Korea’s nuclear weapons program. Intelligence sources say Pyongyang has been deploying thousands of IT operatives abroad to illegally raise funds through fraudulent schemes.
This case is especially troubling because it shows that North Korean hackers managed to set up legal companies inside the United States, a rare and alarming development.
🔐 Three Malware Families, One Lazarus Signature
Analysts found that the job files contained at least three known malware families, capable of opening backdoors, downloading additional malicious payloads, and stealing sensitive information. These tactics align closely with past attacks by the Lazarus Group.
⚠️ FBI Warning: Be Cautious of "Too Good to Be True" Job Offers
Federal agents emphasize that this case is a chilling reminder of how North Korea continues to evolve its cyber threats. Tech and cybersecurity professionals should thoroughly vet unsolicited job offers, especially those from unfamiliar companies. Developers infected by these schemes could lose cryptocurrency or unknowingly grant hackers access to larger systems and exchanges.
#HackerAlert , #CyberSecurity , #NorthKoreaHackers , #CryptoSecurity , #CryptoNewss
Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“
North Korean Hackers Target Crypto with Nim-Based Malware Disguised as Zoom Updates
🔹 Fake Zoom meeting invites and update links deceive Web3 teams
🔹 New NimDoor malware infiltrates macOS with advanced evasion techniques
🔹 Attackers steal browser data, passwords, and Telegram chats
Web3 and Crypto Companies Under Siege by NimDoor Malware
Security experts at SentinelLabs have uncovered a sophisticated malware campaign targeting Web3 startups and cryptocurrency firms. The attacks, linked to North Korean groups, use a combination of social engineering and technical stealth to deploy NimDoor malware, written in the rarely used Nim programming language to bypass antivirus detection.
The Setup: Fake Zoom Meetings Through Telegram
Hackers initiate contact via Telegram, posing as known contacts. They invite victims to schedule meetings via Calendly, then send them links to what appear to be Zoom software updates. These links lead to fake domains like support.us05web-zoom.cloud, mimicking Zoom's legitimate URLs and hosting malicious installation files.
These files contain thousands of lines of whitespace, making them appear "legitimately large." Hidden within are only three crucial lines of code, which download and execute the real attack payload.
NimDoor Malware: Spyware Specifically Targeting macOS
Once executed, the NimDoor malware operates in two main phases:
🔹 Data extraction – stealing saved passwords, browsing histories, and login credentials from popular browsers like Chrome, Firefox, Brave, Edge, and Arc.
🔹 System persistence – maintaining long-term access through stealth background processes and disguised system files.
A key component specifically targets Telegram, stealing encrypted chat databases and decryption keys, giving attackers access to private conversations offline.
Built to Survive: Evasion and Reinstallation Techniques
NimDoor employs a range of advanced persistence mechanisms:
🔹 Automatically reinstalls itself if users try to terminate or delete it
🔹 Creates hidden files and folders that look like legitimate macOS system components
🔹 Connects to the attacker’s server every 30 seconds for instructions, disguised as normal internet traffic
🔹 Delays execution for 10 minutes to avoid early detection by security software
Difficult to Remove Without Professional Tools
Because of these techniques, NimDoor is extremely hard to remove with standard tools. Specialized security software or professional intervention is often required to clean infected systems completely.
Conclusion: Modern Cyberattacks Now Look Like Calendar Invites
Attacks like NimDoor prove how cleverly North Korean groups mimic daily workflows to penetrate even cautious targets. Fake Zoom links and innocent-looking updates can lead to full system compromise.
Users should never download updates from unofficial sources, always verify domain names, and stay vigilant against unexpected software prompts or invitations.
#CyberSecurity , #NorthKoreaHackers , #Web3Security , #CryptoNews , #Hack
Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“
🔹 New NimDoor malware infiltrates macOS with advanced evasion techniques
🔹 Attackers steal browser data, passwords, and Telegram chats
Web3 and Crypto Companies Under Siege by NimDoor Malware
Security experts at SentinelLabs have uncovered a sophisticated malware campaign targeting Web3 startups and cryptocurrency firms. The attacks, linked to North Korean groups, use a combination of social engineering and technical stealth to deploy NimDoor malware, written in the rarely used Nim programming language to bypass antivirus detection.
The Setup: Fake Zoom Meetings Through Telegram
Hackers initiate contact via Telegram, posing as known contacts. They invite victims to schedule meetings via Calendly, then send them links to what appear to be Zoom software updates. These links lead to fake domains like support.us05web-zoom.cloud, mimicking Zoom's legitimate URLs and hosting malicious installation files.
These files contain thousands of lines of whitespace, making them appear "legitimately large." Hidden within are only three crucial lines of code, which download and execute the real attack payload.
NimDoor Malware: Spyware Specifically Targeting macOS
Once executed, the NimDoor malware operates in two main phases:
🔹 Data extraction – stealing saved passwords, browsing histories, and login credentials from popular browsers like Chrome, Firefox, Brave, Edge, and Arc.
🔹 System persistence – maintaining long-term access through stealth background processes and disguised system files.
A key component specifically targets Telegram, stealing encrypted chat databases and decryption keys, giving attackers access to private conversations offline.
Built to Survive: Evasion and Reinstallation Techniques
NimDoor employs a range of advanced persistence mechanisms:
🔹 Automatically reinstalls itself if users try to terminate or delete it
🔹 Creates hidden files and folders that look like legitimate macOS system components
🔹 Connects to the attacker’s server every 30 seconds for instructions, disguised as normal internet traffic
🔹 Delays execution for 10 minutes to avoid early detection by security software
Difficult to Remove Without Professional Tools
Because of these techniques, NimDoor is extremely hard to remove with standard tools. Specialized security software or professional intervention is often required to clean infected systems completely.
Conclusion: Modern Cyberattacks Now Look Like Calendar Invites
Attacks like NimDoor prove how cleverly North Korean groups mimic daily workflows to penetrate even cautious targets. Fake Zoom links and innocent-looking updates can lead to full system compromise.
Users should never download updates from unofficial sources, always verify domain names, and stay vigilant against unexpected software prompts or invitations.
#CyberSecurity , #NorthKoreaHackers , #Web3Security , #CryptoNews , #Hack
Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“
See original
🌐💰 Even North Korea is not safe from crypto traps! 💸🐸
In a mysterious move, North Korean hackers used the (hacked!) Tornado Cash interface to launder $3.1 million of stolen funds, only to later find out that they invested this amount in buying 437.6 billion of PEPE coins 🐸🚀. But the biggest surprise? 🤯 North Korea itself was scammed! It turned out they used a hacked version of the platform, resulting in the loss of some funds during the process! 🔥🎭
Even the most complex criminal minds cannot escape the madness of the crypto world! 🤡💥
#StablecoinSurge #TelegramFounderToLeaveFrance #KaitoXAccountHacked #pepe⚡ #NorthKoreaHackers $PEPE
In a mysterious move, North Korean hackers used the (hacked!) Tornado Cash interface to launder $3.1 million of stolen funds, only to later find out that they invested this amount in buying 437.6 billion of PEPE coins 🐸🚀. But the biggest surprise? 🤯 North Korea itself was scammed! It turned out they used a hacked version of the platform, resulting in the loss of some funds during the process! 🔥🎭
Even the most complex criminal minds cannot escape the madness of the crypto world! 🤡💥
#StablecoinSurge #TelegramFounderToLeaveFrance #KaitoXAccountHacked #pepe⚡ #NorthKoreaHackers $PEPE
🚨 $5.2M+ in Crypto Allegedly Stolen by North Korean Hackers! 🕵️♂️🪙
According to PANews and investigator ZachXBT, a major crypto theft has occurred—allegedly carried out by North Korean DPRK-linked hackers.
What we know so far:
🔐 Victim's multi-sig wallets, exchange accounts, and regular addresses were compromised
💸 Over $5.2 million siphoned off
🌪️ Hackers used Tornado Cash to launder 1,000 ETH and hide the trail
🧬 Suspected wallet addresses:
▪️ 0x9d42a049f88f1db4b304441081aff7c40d857bea
▪️ 0x4be5023ad49573a544a9a4109e4f1880a32fe5c3
▪️ 0x31088345396d0cf00a81a3e3b8e8c5bb8ec768a3
This attack highlights the ongoing threat of state-sponsored cybercrime in the crypto space.
Stay alert. Stay secure.
🔒 Double-check your wallet security and avoid centralized risks.
#CryptoSecurity #ZachXBT #NorthKoreaHackers #BlockchainNews #cryptohacks #TornadoCash #DeFiSecurity #PANews #Web3Alert #HackerNews #CryptoUpdate #CyberThreats
According to PANews and investigator ZachXBT, a major crypto theft has occurred—allegedly carried out by North Korean DPRK-linked hackers.
What we know so far:
🔐 Victim's multi-sig wallets, exchange accounts, and regular addresses were compromised
💸 Over $5.2 million siphoned off
🌪️ Hackers used Tornado Cash to launder 1,000 ETH and hide the trail
🧬 Suspected wallet addresses:
▪️ 0x9d42a049f88f1db4b304441081aff7c40d857bea
▪️ 0x4be5023ad49573a544a9a4109e4f1880a32fe5c3
▪️ 0x31088345396d0cf00a81a3e3b8e8c5bb8ec768a3
This attack highlights the ongoing threat of state-sponsored cybercrime in the crypto space.
Stay alert. Stay secure.
🔒 Double-check your wallet security and avoid centralized risks.
#CryptoSecurity #ZachXBT #NorthKoreaHackers #BlockchainNews #cryptohacks #TornadoCash #DeFiSecurity #PANews #Web3Alert #HackerNews #CryptoUpdate #CyberThreats
Oh Horror 😨😱
Is North Korea planning another hack attack?!
Is Binance the next target?! 🎯 😨
Nah 😁 they are trying hard at the moment.
If we all already know and they are getting exposed it means their chances are much lower.
Old exploits can't be reused.
Plus new security measures and tools like Bubblemaps ($BMT )
Our $BTC and $ETH should be safe 🔐 👮♂️🚨🔒
What is North Korea going to spend the stolen crypto on?!
Food for their starving people 😢 ...
Or make a new War ship 🚢 just to sink it on the first day... again... 😂
#NorthKoreaHackers
Check the article by @Cryptopolitan 👇
Is North Korea planning another hack attack?!
Is Binance the next target?! 🎯 😨
Nah 😁 they are trying hard at the moment.
If we all already know and they are getting exposed it means their chances are much lower.
Old exploits can't be reused.
Plus new security measures and tools like Bubblemaps ($BMT )
Our $BTC and $ETH should be safe 🔐 👮♂️🚨🔒
What is North Korea going to spend the stolen crypto on?!
Food for their starving people 😢 ...
Or make a new War ship 🚢 just to sink it on the first day... again... 😂
#NorthKoreaHackers
Check the article by @Cryptopolitan 👇
Cryptopolitan
--
North Korean hackers pose as IT workers to infiltrate crypto projects and exchanges
North Korean hackers regularly apply to Binance. Investigators have also intercepted resources of hackers spinning up identities to apply to key IT jobs.
The threat of DPRK hackers posing as IT workers is still active. Sources have discovered recent data on the techniques used to spin up fake identities and apply as IT workers.
ZachXBT, known for tracking DPRK hackers, recently discovered information from one of the attacker’s devices. ZachXBT has often called out the risk of hiring DPRK workers, which leads to risks for smart contracts, multisig wallets, or compromised devices.
An unnamed source pointed to records of five DPRK hackers, spinning up 30 identities and applying to key IT tasks in crypto and other projects.
1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects. pic.twitter.com/DEMv0GNM79
— ZachXBT (@zachxbt) August 13, 2025
The teams used fake locations, local names, and identities, overlapping with crypto-friendly countries like Ukraine and Estonia.
North Korean IT workers scour job boards
Leaked documents showed the tools and tracking used by the team, including attempts to build the fake identities.
The hackers used shared documents, revealing a series of Upwork credit purchases. The finding coincides with reports of attempts to buy or rent Upwork accounts and bid on software jobs. Some of the most common jobs included various blockchain roles, smart contract engineering, as well as work on specific projects, including Polygon Labs.
Earlier reports showed that not all North Korean IT workers had hacking in mind or targeted crypto. Some of the workers had the task of earning from legitimate IT jobs, later handing over their pay to the North Korean regime.
An escaped IT worker outlined the scheme, showing that the presence of DPRK IT workers was a constant threat to traditional companies and crypto teams.
Binance filters out DPRK applications almost daily
Binance’s security officer Jimmy Su said the exchange is constantly filtering out candidates. DPRK hackers try to gain access to key crypto positions, and Binance has intercepted both through CV monitoring and at the interview stage. Crypto space also carries unofficial lists of known fake identities, using legitimate-looking LinkedIn accounts and social media profiles.
In the past, Cryptopolitan reported cases where DPRK hackers built the key infrastructure for Web3 projects, leading to compromised smart contracts with known exploit backdoors. These hackers have affected multiple projects, from DeFi to Solana memes. Some of the teams also launched meme tokens as a way of laundering funds.
In addition to public fake profiles, DPRK hackers also use infected code repos or malicious links to make users install malware. Techniques include fake job interviews with links to malware. DPRK hackers also pose as interviewers or project managers, setting up fake meetings with a fake download link.
In some cases, hackers have also proposed to Upwork users to connect to their computer remotely as a way to use new accounts without exposing their identity. Reports have it that some US-based persons agreed to the exchange, allowing the supposed IT workers access via AnyDesk. The hackers also used crypto payments through an intermediary Ethereum wallet, which has been linked to addresses used in large-scale hacks.
Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.
The threat of DPRK hackers posing as IT workers is still active. Sources have discovered recent data on the techniques used to spin up fake identities and apply as IT workers.
ZachXBT, known for tracking DPRK hackers, recently discovered information from one of the attacker’s devices. ZachXBT has often called out the risk of hiring DPRK workers, which leads to risks for smart contracts, multisig wallets, or compromised devices.
An unnamed source pointed to records of five DPRK hackers, spinning up 30 identities and applying to key IT tasks in crypto and other projects.
1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects. pic.twitter.com/DEMv0GNM79
— ZachXBT (@zachxbt) August 13, 2025
The teams used fake locations, local names, and identities, overlapping with crypto-friendly countries like Ukraine and Estonia.
North Korean IT workers scour job boards
Leaked documents showed the tools and tracking used by the team, including attempts to build the fake identities.
The hackers used shared documents, revealing a series of Upwork credit purchases. The finding coincides with reports of attempts to buy or rent Upwork accounts and bid on software jobs. Some of the most common jobs included various blockchain roles, smart contract engineering, as well as work on specific projects, including Polygon Labs.
Earlier reports showed that not all North Korean IT workers had hacking in mind or targeted crypto. Some of the workers had the task of earning from legitimate IT jobs, later handing over their pay to the North Korean regime.
An escaped IT worker outlined the scheme, showing that the presence of DPRK IT workers was a constant threat to traditional companies and crypto teams.
Binance filters out DPRK applications almost daily
Binance’s security officer Jimmy Su said the exchange is constantly filtering out candidates. DPRK hackers try to gain access to key crypto positions, and Binance has intercepted both through CV monitoring and at the interview stage. Crypto space also carries unofficial lists of known fake identities, using legitimate-looking LinkedIn accounts and social media profiles.
In the past, Cryptopolitan reported cases where DPRK hackers built the key infrastructure for Web3 projects, leading to compromised smart contracts with known exploit backdoors. These hackers have affected multiple projects, from DeFi to Solana memes. Some of the teams also launched meme tokens as a way of laundering funds.
In addition to public fake profiles, DPRK hackers also use infected code repos or malicious links to make users install malware. Techniques include fake job interviews with links to malware. DPRK hackers also pose as interviewers or project managers, setting up fake meetings with a fake download link.
In some cases, hackers have also proposed to Upwork users to connect to their computer remotely as a way to use new accounts without exposing their identity. Reports have it that some US-based persons agreed to the exchange, allowing the supposed IT workers access via AnyDesk. The hackers also used crypto payments through an intermediary Ethereum wallet, which has been linked to addresses used in large-scale hacks.
Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.
See original
Lazarus Group (a hacker group supported by North Korea 🇰🇵) launched an attack on the OKX DEX platform! 🚨
The attack led to a temporary suspension of service by OKX, which is a popular cryptocurrency exchange. The Lazarus Group is known to be one of the most dangerous groups on the internet, carrying out attacks targeting cryptocurrency platforms and stealing users' funds to finance the North Korean regime.
#TonRally #Lazarus #NorthKoreaHackers #BTC #bitcoin
$BTC
The attack led to a temporary suspension of service by OKX, which is a popular cryptocurrency exchange. The Lazarus Group is known to be one of the most dangerous groups on the internet, carrying out attacks targeting cryptocurrency platforms and stealing users' funds to finance the North Korean regime.
#TonRally #Lazarus #NorthKoreaHackers #BTC #bitcoin
$BTC
See original
ZachXBT Exposes the Myth of the "Genius" of North Korean Hackers.
In the world of cybersecurity, the name ZachXBT has become synonymous with investigations and exposés. This independent blockchain researcher, known for his in-depth analyses of crypto fraud, recently criticized the popular myth of the "genius" of North Korean hackers. In his latest post on Twitter (now X), ZachXBT emphasized that these cybercriminals, linked to groups like Lazarus, are far from the "technical geniuses" they are made out to be.
Bybit Cold Wallet Hack & North Korea's 1.5 Billion ETH Strategic Reserves: A Coincidence or a Master Plan?
In a shocking development that has sent ripples through the cryptocurrency community, Bybit, one of the leading global crypto exchanges, has confirmed a massive hack targeting its cold wallet. The breach reportedly led to the theft of around 1.5 billion ETH, a staggering amount of digital assets, raising eyebrows across the industry. The news of the hack has shaken investor confidence, and security protocols for exchanges are now under intense scrutiny.
Adding another layer of intrigue, just days after the hack, North Korea made headlines by announcing the establishment of 1.5 billion ETH in its own "strategic reserves." While the details are still murky, sources suggest that this is a significant move by the North Korean regime to bolster its cyber capabilities, and some speculate that the two events may be linked.
With North Korea’s well-documented history of cyberattacks and digital asset thefts, the timing of these announcements has sparked speculation about potential involvement in the hack. The fact that both incidents revolve around 1.5 billion ETH has left many wondering: Is it a mere coincidence, or is there a larger geopolitical strategy at play?
Experts are divided on the issue. Some believe the breach could be the work of highly skilled hackers with access to sophisticated tools, possibly state-sponsored. Others think that North Korea’s announcement might be a propaganda play, leveraging the hack to highlight its growing influence in the digital currency space.
The situation remains fluid, but one thing is clear: as crypto evolves, the intersection of national security, cybersecurity, and digital currencies becomes increasingly complex. Investors and regulators alike will be watching closely to see how this saga unfolds.
#BybitSecurityBreach #NorthKoreaHackers #ETH $ETH $BTC $XRP
In a shocking development that has sent ripples through the cryptocurrency community, Bybit, one of the leading global crypto exchanges, has confirmed a massive hack targeting its cold wallet. The breach reportedly led to the theft of around 1.5 billion ETH, a staggering amount of digital assets, raising eyebrows across the industry. The news of the hack has shaken investor confidence, and security protocols for exchanges are now under intense scrutiny.
Adding another layer of intrigue, just days after the hack, North Korea made headlines by announcing the establishment of 1.5 billion ETH in its own "strategic reserves." While the details are still murky, sources suggest that this is a significant move by the North Korean regime to bolster its cyber capabilities, and some speculate that the two events may be linked.
With North Korea’s well-documented history of cyberattacks and digital asset thefts, the timing of these announcements has sparked speculation about potential involvement in the hack. The fact that both incidents revolve around 1.5 billion ETH has left many wondering: Is it a mere coincidence, or is there a larger geopolitical strategy at play?
Experts are divided on the issue. Some believe the breach could be the work of highly skilled hackers with access to sophisticated tools, possibly state-sponsored. Others think that North Korea’s announcement might be a propaganda play, leveraging the hack to highlight its growing influence in the digital currency space.
The situation remains fluid, but one thing is clear: as crypto evolves, the intersection of national security, cybersecurity, and digital currencies becomes increasingly complex. Investors and regulators alike will be watching closely to see how this saga unfolds.
#BybitSecurityBreach #NorthKoreaHackers #ETH $ETH $BTC $XRP
𝗡𝗼𝗿𝘁𝗵 𝗞𝗼𝗿𝗲𝗮 𝗵𝗮𝘀 𝗯𝗲𝗲𝗻 𝗮𝗰𝗰𝘂𝘀𝗲𝗱 𝗼𝗳 𝗦𝘁𝗲𝗮𝗹𝗶𝗻𝗴 £𝟭𝟟 𝗠𝗶𝗹𝗹𝗶𝗼𝗻 𝗶𝗻 𝗕𝗶𝘁𝗰𝗼𝗶𝗻 from Lykke, a crypto trading platform registered in the UK. The hack forced the company to freeze trading, shut down operations, and later get liquidated in court.
#NorthKoreaHackers #UK #bitcoin #Heist #CryptoNews
#NorthKoreaHackers #UK #bitcoin #Heist #CryptoNews
Північнокорейські хакери вкрали $2 млрд у криптовалюті: Рекордний рік кіберкрадіжок.
Північнокорейські хакери встановили новий рекорд, викравши понад $2 мільярди у криптовалюті лише за 2025 рік, що перевищує попередні показники втричі. За даними аналітичної фірми Elliptic, це найбільший річний обсяг крадіжок в історії, з трьома місяцями до кінця року. Основний внесок — хак біржі Bybit у лютому, коли злодії вкрали $1,46 млрд, один з найбільших інцидентів у криптосекторі.
З 2017 року загальний обсяг вкрадених активів Північною Кореєю перевищив $6 млрд, які, за оцінками ООН, фінансують ядерну програму режиму Кім Чен Ина. Цьогорічний сплеск пояснюється переходом від технічних вразливостей до соціальної інженерії: хакери з груп на кшталт Lazarus обманюють співробітників бірж фішингом, фальшивими пропозиціями роботи чи зламаними соцмережами. "Слабке місце в безпеці криптовалют — тепер людина, а не технології", — зазначають аналітики.
Крім Bybit, жертвами стали LND.fi, WOO X, Seedify та BitoPro, з втратами від $11 млн до $100 млн на одного користувача. Elliptic приписує понад 30 атак Північній Кореї, включаючи цілі на багатих власників гаманців, які часто ігнорують корпоративні заходи безпеки. Chainalysis оцінює втрати в $2,17 млрд, підкреслюючи, що північнокорейські операції становлять значну частку від загальних $2,2 млрд крадіжок у 2025 році.
Ці кібератаки підривають довіру до крипторинку, особливо на тлі відновлення цін. Західні агенції закликають до посилення міжнародної співпраці: відстеження через блокчейн, заморожування активів у міксерах та DeFi. Фінтех-компанії, як Elliptic, допомагають правоохоронцям блокувати відмивання. Проте хакери адаптуються, використовуючи нові методи, що робить криптобезпеку пріоритетом для інвесторів і регуляторів.
#NorthKoreaHackers #CryptoThefts #LazarusGroup #BlockchainSecurity #Cybercrime #CryptoNews #2025Hacks
Підписуйтесь на #MiningUpdates , щоб бути в курсі новин про криптовидобуток, регулювання та ринкові тренди!
З 2017 року загальний обсяг вкрадених активів Північною Кореєю перевищив $6 млрд, які, за оцінками ООН, фінансують ядерну програму режиму Кім Чен Ина. Цьогорічний сплеск пояснюється переходом від технічних вразливостей до соціальної інженерії: хакери з груп на кшталт Lazarus обманюють співробітників бірж фішингом, фальшивими пропозиціями роботи чи зламаними соцмережами. "Слабке місце в безпеці криптовалют — тепер людина, а не технології", — зазначають аналітики.
Крім Bybit, жертвами стали LND.fi, WOO X, Seedify та BitoPro, з втратами від $11 млн до $100 млн на одного користувача. Elliptic приписує понад 30 атак Північній Кореї, включаючи цілі на багатих власників гаманців, які часто ігнорують корпоративні заходи безпеки. Chainalysis оцінює втрати в $2,17 млрд, підкреслюючи, що північнокорейські операції становлять значну частку від загальних $2,2 млрд крадіжок у 2025 році.
Ці кібератаки підривають довіру до крипторинку, особливо на тлі відновлення цін. Західні агенції закликають до посилення міжнародної співпраці: відстеження через блокчейн, заморожування активів у міксерах та DeFi. Фінтех-компанії, як Elliptic, допомагають правоохоронцям блокувати відмивання. Проте хакери адаптуються, використовуючи нові методи, що робить криптобезпеку пріоритетом для інвесторів і регуляторів.
#NorthKoreaHackers #CryptoThefts #LazarusGroup #BlockchainSecurity #Cybercrime #CryptoNews #2025Hacks
Підписуйтесь на #MiningUpdates , щоб бути в курсі новин про криптовидобуток, регулювання та ринкові тренди!
⚠️ State-Sponsored Crypto Hacks Hit $3 Billion
A sobering new report reveals a critical threat to the blockchain industry. In less than two years, North Korean state-sponsored hackers have stolen nearly $3 billion in digital assets. This illicit activity now represents a core part of their national strategy, accounting for an astonishing one-third of the nation's foreign currency revenue.
This market update confirms the attacks are systematic and sophisticated. These groups are actively targeting all corners of Web3, from DeFi protocols to trading platforms and cross-chain bridges. This poses a persistent, well-funded risk to the entire crypto ecosystem and the security of digital assets.
We urge all users to prioritize their cybersecurity. Implement strong 2FA (Authenticator App or YubiKey, not SMS), stay vigilant against phishing attempts, and interact only with thoroughly audited platforms. Protecting your assets is essential to navigating the DeFi and blockchain space safely.
#DEFİ #NorthKoreaHackers #CryptoHack
This market update confirms the attacks are systematic and sophisticated. These groups are actively targeting all corners of Web3, from DeFi protocols to trading platforms and cross-chain bridges. This poses a persistent, well-funded risk to the entire crypto ecosystem and the security of digital assets.
We urge all users to prioritize their cybersecurity. Implement strong 2FA (Authenticator App or YubiKey, not SMS), stay vigilant against phishing attempts, and interact only with thoroughly audited platforms. Protecting your assets is essential to navigating the DeFi and blockchain space safely.
#DEFİ #NorthKoreaHackers #CryptoHack
See original
North Korean hackers hide malicious code in the ETH blockchain
🔍 Details of what they have detected
According to the Google Threat Intelligence Group (GTIG), it was observed that UNC5342 since February 2025 initiated campaigns where they use EtherHiding to store encrypted malicious payloads within smart contracts or transactions on Ethereum/BNB.
In that modus operandi:
The attackers create fake 'job offers', contacting developers or people in the blockchain space via LinkedIn or other platforms.
Victims download files as if it were part of a technical test or interview; those files contain malicious loaders that, when executed, query a smart contract that delivers the next malicious step.
According to the Google Threat Intelligence Group (GTIG), it was observed that UNC5342 since February 2025 initiated campaigns where they use EtherHiding to store encrypted malicious payloads within smart contracts or transactions on Ethereum/BNB.
In that modus operandi:
The attackers create fake 'job offers', contacting developers or people in the blockchain space via LinkedIn or other platforms.
Victims download files as if it were part of a technical test or interview; those files contain malicious loaders that, when executed, query a smart contract that delivers the next malicious step.
Північна Корея і $2 мільярди: як хакери з Лазаря переписують історію Web3
🦹 Схоже, коли світові трейдери змагаються, хто зловить наступний “x100”, десь у Пхеньяні сидять люди, які вже знайшли свій гарантований прибуток. За даними аналітичної компанії Elliptic, у 2025 році хакери, пов’язані з Північною Кореєю, вкрали понад $2 млрд у криптоактивах. Це — новий історичний рекорд.
Попередній максимум належав 2022-му: тоді загальні втрати становили близько $1,35 млрд. Якщо скласти все, що підтверджено з 2017 року, отримаємо принаймні $6 млрд. Але експерти одразу попереджають: це лише те, що вдалося виявити. Реальні цифри, імовірно, більші.
💣 Рекордний рік крадіжок
Найгучніша атака сталася у лютому цього року — з криптобіржі Bybit було викрадено близько $1,46 млрд. Це найбільша одиночна крадіжка за всю історію крипторинку.
Американські слідчі офіційно пов’язують інцидент із Lazarus Group, хакерським підрозділом, який діє під егідою північнокорейського режиму.
На цьому список не закінчується. У минулі роки “під ніж” уже потрапляли:
🎮 Axie Infinity — $625 млн (2022);🌉 Harmony One Bridge — $100 млн (2022);💱 WazirX — $235 млн (2024).
І якщо раніше більшість атак проводили через технічні вразливості у смартконтрактах, то 2025-й став роком соціальної інженерії.
🧠 Соціальна інженерія — найсмертоносніша зброя
Хакери все частіше обирають не комп’ютери, а людей. Фальшиві рекрутери, “журналісти”, фішингові листи, запити на інтерв’ю, підроблені пропозиції співпраці — усе це стало новим фронтом війни за доступ до приватних ключів.
Багато атак починаються з простого листа в LinkedIn або X. Людина відкриває документ, що виглядає як “brief.docx”, і за кілька хвилин її ноутбук перетворюється на трофей для Lazarus.
Іронія в тому, що більшість таких атак не вимагають блискучих технічних навичок — лише розуміння людської довіри.
🧩 Як “вкрадені токени” перетворюються на ядерне паливо
ООН неодноразово заявляла: криптовалюта, викрадена Північною Кореєю, ймовірно, використовується для фінансування її ядерної програми.
Тобто кожен токен, який потрапляє в руки Lazarus, потенційно може закінчити свій шлях у вигляді балістичної ракети.
Для “відмивання” таких коштів зазвичай застосовуються міксери, децентралізовані біржі, каскадні свопи та міжланцюгові бриджі.
І хоча аналітичні компанії давно навчилися відстежувати ці рухи, 100% контроль — поки що міф.
🧭 Уроки для спільноти Web3
Безпека починається з голови. Ніхто не зламає вашу seed-фразу, якщо ви її не зіллєте самі.Перевіряйте всі запити. Навіть якщо це “представник Binance” чи “журналіст Forbes”, завжди верифікуйте особу.Оновлюйте апаратні гаманці. Старі моделі Ledger чи Trezor можуть мати вразливості.Використовуйте багаторівневий захист. Seed окремо, ключі окремо, холодні гаманці — обов’язково.Не легковажте фішингом. Одне натискання на файл — і у вас нові “інвестори” з Пхеньяну.
🧠 І трохи філософії
У світі Web3 ми часто говоримо про “децентралізацію довіри”. Але поки довіра — це люди, а не код, найбільша вразливість залишатиметься людською.
І саме тому навіть найпросунутіші блокчейн-технології не замінять критичного мислення.
💬 Як ви вважаєте — чи повинні біржі активніше блокувати підозрілі адреси, навіть якщо це суперечить духу децентралізації?
Пишіть у коментарях — обговоримо, де проходить межа між свободою і безпекою. І не забувайте підписатися на мене, бо попереду ще багато цікавинок!
#CryptoSecurity #Elliptic #Lazarus #NorthKoreaHackers #Web3
Попередній максимум належав 2022-му: тоді загальні втрати становили близько $1,35 млрд. Якщо скласти все, що підтверджено з 2017 року, отримаємо принаймні $6 млрд. Але експерти одразу попереджають: це лише те, що вдалося виявити. Реальні цифри, імовірно, більші.
💣 Рекордний рік крадіжок
Найгучніша атака сталася у лютому цього року — з криптобіржі Bybit було викрадено близько $1,46 млрд. Це найбільша одиночна крадіжка за всю історію крипторинку.
Американські слідчі офіційно пов’язують інцидент із Lazarus Group, хакерським підрозділом, який діє під егідою північнокорейського режиму.
На цьому список не закінчується. У минулі роки “під ніж” уже потрапляли:
🎮 Axie Infinity — $625 млн (2022);🌉 Harmony One Bridge — $100 млн (2022);💱 WazirX — $235 млн (2024).
І якщо раніше більшість атак проводили через технічні вразливості у смартконтрактах, то 2025-й став роком соціальної інженерії.
🧠 Соціальна інженерія — найсмертоносніша зброя
Хакери все частіше обирають не комп’ютери, а людей. Фальшиві рекрутери, “журналісти”, фішингові листи, запити на інтерв’ю, підроблені пропозиції співпраці — усе це стало новим фронтом війни за доступ до приватних ключів.
Багато атак починаються з простого листа в LinkedIn або X. Людина відкриває документ, що виглядає як “brief.docx”, і за кілька хвилин її ноутбук перетворюється на трофей для Lazarus.
Іронія в тому, що більшість таких атак не вимагають блискучих технічних навичок — лише розуміння людської довіри.
🧩 Як “вкрадені токени” перетворюються на ядерне паливо
ООН неодноразово заявляла: криптовалюта, викрадена Північною Кореєю, ймовірно, використовується для фінансування її ядерної програми.
Тобто кожен токен, який потрапляє в руки Lazarus, потенційно може закінчити свій шлях у вигляді балістичної ракети.
Для “відмивання” таких коштів зазвичай застосовуються міксери, децентралізовані біржі, каскадні свопи та міжланцюгові бриджі.
І хоча аналітичні компанії давно навчилися відстежувати ці рухи, 100% контроль — поки що міф.
🧭 Уроки для спільноти Web3
Безпека починається з голови. Ніхто не зламає вашу seed-фразу, якщо ви її не зіллєте самі.Перевіряйте всі запити. Навіть якщо це “представник Binance” чи “журналіст Forbes”, завжди верифікуйте особу.Оновлюйте апаратні гаманці. Старі моделі Ledger чи Trezor можуть мати вразливості.Використовуйте багаторівневий захист. Seed окремо, ключі окремо, холодні гаманці — обов’язково.Не легковажте фішингом. Одне натискання на файл — і у вас нові “інвестори” з Пхеньяну.
🧠 І трохи філософії
У світі Web3 ми часто говоримо про “децентралізацію довіри”. Але поки довіра — це люди, а не код, найбільша вразливість залишатиметься людською.
І саме тому навіть найпросунутіші блокчейн-технології не замінять критичного мислення.
💬 Як ви вважаєте — чи повинні біржі активніше блокувати підозрілі адреси, навіть якщо це суперечить духу децентралізації?
Пишіть у коментарях — обговоримо, де проходить межа між свободою і безпекою. І не забувайте підписатися на мене, бо попереду ще багато цікавинок!
#CryptoSecurity #Elliptic #Lazarus #NorthKoreaHackers #Web3
🚨 North Korea is likely behind the $1.5bn Bybit hack, researchers say:
🤔Is it's true 👇👇👇👇👇👇👇.
#BybitSecurityBreach #NorthKoreaHackers #Alert🔴 #Binance #market
🤔Is it's true 👇👇👇👇👇👇👇.
#BybitSecurityBreach #NorthKoreaHackers #Alert🔴 #Binance #market
See original
South Korea punishes 15 North Koreans for cryptocurrency theft and cyber theft
The sanctioned agents are accused of generating funds for North Korea's nuclear weapons development program.
North Korean hackers are being pursued by governments around the world and are blamed for over half of the cryptocurrency value stolen in 2024.
#NorthKoreaHackers
The sanctioned agents are accused of generating funds for North Korea's nuclear weapons development program.
North Korean hackers are being pursued by governments around the world and are blamed for over half of the cryptocurrency value stolen in 2024.
#NorthKoreaHackers
North Korea's Lazarus Group behind the $1.2 Billion Ethereum Heist. 🇰🇵
A massive $1.19 billion crypto theft has shaken the industry, with North Korea’s Lazarus Group accused of hacking an Ethereum wallet on Bybit. The February 23 attack caused Ethereum’s price to drop 4%, reigniting concerns over exchange security.
Blockchain forensics firm Arkham Intelligence linked the breach to Lazarus, known for funding Pyongyang through cybercrime. Bybit CEO Zhou confirmed 350,000 withdrawal requests but assured users that assets remained secure. Recovery efforts face challenges despite global law enforcement involvement.
The heist follows North Korea’s growing reliance on crypto theft, with Lazarus previously orchestrating billion-dollar breaches, including the $625M Ronin Network hack. Experts stress the need for multi-signature wallets, AI-driven security, and stronger regulatory collaboration to combat state-backed cyber threats.
#NorthKoreaHackers #northkorea #LazarusGroup #Lazarus #Ethereum $ETH
A massive $1.19 billion crypto theft has shaken the industry, with North Korea’s Lazarus Group accused of hacking an Ethereum wallet on Bybit. The February 23 attack caused Ethereum’s price to drop 4%, reigniting concerns over exchange security.
Blockchain forensics firm Arkham Intelligence linked the breach to Lazarus, known for funding Pyongyang through cybercrime. Bybit CEO Zhou confirmed 350,000 withdrawal requests but assured users that assets remained secure. Recovery efforts face challenges despite global law enforcement involvement.
The heist follows North Korea’s growing reliance on crypto theft, with Lazarus previously orchestrating billion-dollar breaches, including the $625M Ronin Network hack. Experts stress the need for multi-signature wallets, AI-driven security, and stronger regulatory collaboration to combat state-backed cyber threats.
#NorthKoreaHackers #northkorea #LazarusGroup #Lazarus #Ethereum $ETH
Login to explore more contents