Ripple shares intelligence on North Korea-linked hackers as crypto attacks shift toward social engineering, following major DeFi breaches
The Block •
Revision history
4 recorded changes
Want your article here?
Promote with Leviathan NewsRipple has started sharing detailed threat intelligence on North Korea‑linked crypto hacking campaigns with the wider industry, aiming to help exchanges and protocols defend against a clear shift from technical exploits toward long-horizon social engineering attacks. The data is being distributed through the nonprofit Crypto ISAC’s new API, providing members with enriched indicators such as fraud-associated domains, wallet addresses, and profiles of suspected DPRK IT operatives, including their LinkedIn identities and communication details. According to Crypto ISAC and coverage of the move, this initiative responds directly to recent high‑impact incidents like the roughly $280–285 million Drift Protocol attack, where a DPRK‑linked group spent around six months building trust with project contributors before draining user funds, despite no smart contract vulnerability being involved. Ripple’s contribution is positioned as part of a broader collective‑defense model in which founding members such as Ripple and Coinbase integrate shared intelligence into their security operations so that firms can detect and block DPRK‑associated infrastructure and personas in near real time, rather than only reacting after breaches. The shift is occurring against a backdrop of rapidly growing North Korean involvement in crypto theft: TRM Labs data cited by Crypto ISAC indicates that DPRK‑linked operations rose from under 10% of global crypto hack losses in 2020–2021 to roughly 64% of global losses in 2025, underscoring the systemic risk to Web3 projects and service providers.
AI-generated background, compiled from web sources — not editorial content.
More coverage
- [PDF] North Korea Using Social Engineering to Enable Hacking of Think ... (ic3.gov)
- North Korean Hackers Use Six-Month Social Engineering Campaign ... (iansresearch.com)
- North Korea-linked actor targets Web3 execs in social-engineering ... (cybersecuritydive.com)
- North Korean Hackers Are Infiltrating Crypto Companies. Ripple and ... (cryptoisac.org)
- Ripple Opens Threat Intelligence on North Korea-Linked Crypto ... (coinmarketcap.com)
Explore the topic
More on North Korea
Consensys confirms North Korea-linked contractor accessed MetaMask code for one month; finds no stolen assets or data
Dropsitenews ·
Lazarus Group has stolen $6B in crypto since 2017 as North Korea drives 70% of 2026 exploits
info.arkm ·
Aave launches binding Arbitrum governance vote to recover $71M in disputed ETH as North Korean terrorism creditors battle ownership claims in court
Coindesk ·
Federal Judge approves transfer of $71M in ETH tied to North Korea-linked exploit into Aave, while terrorism plaintiffs maintain legal claims over frozen assets
Coindesk ·
Ether.fi backs Arbitrum plan to swiftly return user funds, dismissing claims linking ETH to North Korean ownership as baseless and expecting legal threats to be overturned soon
𝕏/@ether_fi ·
Why Arbitrum Decided To Take Back $72M North Korea Stole
Youtube ·
Consensys confirms North Korea-linked contractor accessed MetaMask code for one month; finds no stolen assets or data
Dropsitenews ·
Lazarus Group has stolen $6B in crypto since 2017 as North Korea drives 70% of 2026 exploits
info.arkm ·
Aave launches binding Arbitrum governance vote to recover $71M in disputed ETH as North Korean terrorism creditors battle ownership claims in court
Coindesk ·
Federal Judge approves transfer of $71M in ETH tied to North Korea-linked exploit into Aave, while terrorism plaintiffs maintain legal claims over frozen assets
Coindesk ·
Ether.fi backs Arbitrum plan to swiftly return user funds, dismissing claims linking ETH to North Korean ownership as baseless and expecting legal threats to be overturned soon
𝕏/@ether_fi ·
Why Arbitrum Decided To Take Back $72M North Korea Stole
Youtube ·