Ripple shares North Korean hacker data with crypto firms

Ripple, a US blockchain payments company, said it started sharing internal threat data on North Korean hackers with Crypto ISAC, the crypto sector’s threat sharing group.

Attacks are shifting from code exploits to social engineering.

Ripple and Crypto ISAC said the US$285 million Drift theft followed months of contact with contributors, malware on their devices, and stolen keys, rather than smart contract flaws that security tools are built to catch.

They said shared data such as LinkedIn profiles, email addresses, locations, and phone numbers could help firms spot repeat applicants tied to the same campaigns.

Meanwhile the April Drift and Kelp attacks were publicly attributed to Lazarus Group and totaled US$577 million.

🔗 Source: CoinDesk

🧠 Food for thought

Implications, context, and why it matters.

North Korean operatives blend fraud with job scams

North Korea runs overseas IT worker schemes that brought in nearly US$800 million in 2024. The U.S. Treasury said the money helped fund weapons of mass destruction and ballistic missile programs 1.
Workers use fake documents, stolen identities, and made-up personas to land jobs at real companies 1.
Some campaigns stretch over weeks. Operatives may pose as recruiters and stage Google Meet interviews. They may also send take-home coding tests that carry malware, said Fireblocks, a crypto custody and security company 2.
To look U.S.-based, operatives can route traffic through virtual private network (VPN) services such as Astrill VPN and use AI-built identities. LevelBlue, a cybersecurity company, and Microsoft described those tactics 3.

Crypto firms are pooling signals on repeat attackers

In the past, a threat actor who failed a background check at one crypto firm could move to the next. Each security team then had to begin its review from scratch 4.
Ripple is giving Crypto ISAC its internal North Korea-related threat intelligence through a new application programming interface (API). Member firms, including Coinbase, can send richer data into their security operations 5.
The system passes along more than wallet addresses. It also includes LinkedIn profiles, email addresses, locations, and phone numbers, which can help firms spot repeat personas linked to wider campaigns 5.
The approach turns one-off screening into a shared warning system for crypto firms and other sectors targeted by state-backed hacking groups.