The North Korean threat actor known as UNC1069 has been observed targeting the crypto sector to steal sensitive data from Windows and macOS systems with the ultimate goal of facilitating financial theft. UNC1069 was assessed to be active from April 2018. It has a history of running social engineering campaigns for financial gain using fake meeting invites and posing as investors from reputable companies.

North Korean hackers target firms with deepfake Zoom calls

In its latest report, Google Mandiant researchers detailed their investigation into an intrusion targeting a FinTech company in the crypto industry. According to investigators, the intrusion began with a compromised Telegram account belonging to a crypto industry executive. The attackers used the hijacked profile to contact the victim.

They gradually built trust before sending a Calendly invitation for a video meeting. The meeting link directed the target to a fake Zoom domain hosted on infrastructure under the threat actors’ control. During the call, the victim reported seeing what appeared to be a deepfake video of a CEO from another crypto company.

“While Mandiant was unable to recover forensic evidence to independently verify the use of AI models in this specific instance, the reported ruse is similar to a previously publicly reported incident with similar characteristics, where deepfakes were also allegedly used,” the report stated.

AI-link scams are on the rise

The attackers created the impression of audio problems in the meeting to justify the next step. They instructed the victim to run troubleshooting commands on their device. Those commands, tailored for both macOS and Windows systems, secretly initiated the infection chain. As a result, several malware components were activated. Mandiant identified seven distinct types of malware used during the attack.

The tools were designed to access keychain and steal passwords, retrieve browser cookies and login information, access Telegram session information, and obtain other private files. Investigators assessed that the objective was twofold: To enable potential crypto theft and harvest data that could support future social engineering attacks. The investigation revealed an unusually large volume of tooling dropped onto a single host.

The incident is part of a broader pattern. North Korean-linked actors siphoned more than $300 million by posing as trusted industry figures during fraudulent Zoom and Microsoft Teams meetings. The scale of activity throughout the year was even more striking. As reported by Cryptopolitan, North Korean threat groups were responsible for $2.02 billion in stolen digital assets in 2025, a 51% increase from the previous year.

The post North Korean hackers deploy deepfake calls to hack crypto firms first appeared on Coinfea.

According to the United Kingdom’s Office of Financial Sanctions Implementation, a division of the Treasury, the hack was carried out by “malicious Democratic People’s Republic of Korea cyberactors”, a report from The Telegraph said. The attack hit both Bitcoin and Ethereum networks.

The group believed to be behind the heist is Lazarus, the North Korean hacking group linked to multiple major crypto attacks around the world. If confirmed, this would be their largest crypto theft from any British target to date. The stolen money is suspected to be part of Pyongyang’s broader effort to fund its nuclear weapons program and military projects, with billions already funneled through past crypto raids.

United Kingdom agency blames North Korea for BTC theft

The attackers of the crypto trading platform were identified by Whitestream, an Israeli crypto research company. They tracked the funds and said the hackers cleaned the money through two crypto companies that are widely known for helping users hide their tracks. “They moved the funds using platforms that basically ignore money-laundering rules,” Whitestream said. These mixers and unregulated exchanges made it hard to follow the trail.

However, the claim doesn’t seem to sit well with everyone, as some researchers agree that there is no solid proof to tie the hack directly to North Korea. They claim it is too early to pinpoint the responsible party. Lykke, the company hit by the hack, was founded in 2015 by Richard Olsen, a descendant of Swiss banking legend Julius Baer. It ran operations out of Zug, Switzerland, but its corporate registration was in the UK.

Lykke promised commission-free trading and attracted a good chunk of retail users, but things spiraled after the attack. The company announced the $22.8 million loss last year, and despite saying it could recover user funds, it froze trading and shut down by December 2023. In March 2025, a UK court ordered Lykke to be liquidated after over 70 users took legal action to recover their funds. These customers said they had lost £5.7 million when the platform stopped operating.

Interpath Advisory was invited to handle the process. Before the hack, the UK’s Financial Conduct Authority had already warned about Lykke in 2023, saying the company wasn’t licensed to offer services to British consumers. That red flag wasn’t enough to stop users from investing, and once the heist happened, Lykke’s UK arm couldn’t keep up with claims.

Richard was declared bankrupt in January 2025 and has been under investigation in Switzerland for possible criminal wrongdoing, according to documents from British courts. His company’s fall is now part of a bigger story, one where North Korea keeps grabbing crypto to keep its regime afloat, no matter who gets burned in the process.

The post North Korea fingered in BTC heist that crippled British platform first appeared on Coinfea.

According to a Chinese correspondent Colin Wu, a user on microblogging platform X, alerted the Hyperliquid team to the development, highlighting a potential attack. The user added that the Democratic People’s Republic of Korea (DPRK) does not trade, it tests. Hyperliquid’s HYPE token has been making waves in the industry, recently smashing the $11 billion trading volume mark thanks to its recent airdrop. Experts hope the token will reach above $35.02, but the recent development has worried everyone.

Experts offer help to Hyperliquid as DPRK hacks dominate in 2024

About two weeks ago, crypto KOL Tayvano offered to help Hyperliquid counter any potential threats from the acts. In a letter, he highlighted the likely dangers that the North Korean hackers’ familiarity with the platform poses. “I would like to walk you through some of the measures that your team can and should take to mitigate the risk of a sophisticated attack,” Tayvano said.

The letter described the qualities of hackers from DPRK, noting that they were unrelenting, persistent, and sophisticated. The group also has access to zero-day vulnerabilities, one that Chrome fixed some time ago. Tayvano said Hyperliquid should open a line of communication with experts, hoping that it would help both parties share measures and updates to help counter any potential threats aimed at the platform.

Meanwhile, a recent Chainalysis report highlighted that hackers from North Korea were responsible for about half of the entire theft in the crypto industry this year. According to the report, the hackers stole about $1.34 billion, intensifying their efforts than the previous years and attacking a wide range of platforms. Hacks netted DPRK $50 to $100 million in profits, more than the figure they saw in 2023. Chainalysis said it was due to the hackers growing expertise in carrying out massive attacks.

Countries set to join hands to mete out sanctions

North Korean hackers’ intensified attacks have caused countries to form a coalition to tackle the growing menace. A recent team-up between the United States and the United Arab Emirates led to the disruption of a money laundering syndicate for the DPRK. A statement from the Treasury’s Office of Foreign Assets Control (OFAC) noted that two Chinese nationals and a UAE-based company were sanctioned for laundering money for North Korea.

The sanctions by OFAC led to the arrest of the individuals, freezing the firm in the process. This means that both the firm and the individuals have been barred from using global financial systems. The agency has also issued warnings to entities planning to work with them, noting that they risk sanctions and other penalties. The sanctions are also part of a wider crackdown on North Korea’s missile program funding since most of the resources are from proceeds from hacks and money laundering.

The post North Korean hackers lose more than $700,000 trading on Hyperliquid first appeared on Coinfea.

While North Korean hacking activities appear to have declined in 2023, Chainalysis warns against interpreting this as a sign of reduced criminal intent. The firm’s data shows that North Korean hackers have stolen around $340.4 million in cryptocurrency this year, a figure dwarfed by the over $1.7 billion reported in 2022.

 However, the astronomical figures from last year set an unusually high benchmark. North Korea-linked groups still account for nearly 30% of all cryptocurrency stolen through hacks this year, maintaining their position as one of the largest active threats in the cybercrime landscape.

The partnership between North Korean and Russian cybercriminals poses a formidable challenge for international law enforcement agencies. Russia’s well-documented uncooperative stance toward international efforts significantly reduces the likelihood of recovering stolen assets. This comes as independent sanctions monitors and the United Nations have raised alarms about North Korea’s evolving cyber tactics, including state-sponsored hacking groups targeting cryptocurrency and financial exchanges globally.

The cross-border nature of cryptocurrencies offers both challenges and opportunities for law enforcement. While it facilitates collaboration among rogue nations, the transparent nature of blockchain technology provides investigative advantages.

The recent findings by Chainalysis serve as a stark reminder of the evolving complexities of cybercrime. As North Korean hackers adapt their strategies and form alliances with like-minded entities in Russia, the stakes in combating crypto-related crimes continue to rise. International efforts must intensify to counter these growing threats and maintain global financial systems’ integrity.

The post North Korean hackers are collaborating with Russian exchanges for crypto money laundering first appeared on Coinfea.

This disclosure coincides with recent diplomatic discussions between Russia and North Korea, further intensifying global apprehensions. While the stolen amount is lower than the 2017 peak of $1.65 billion, North Korea accounts for over one-third of all cryptocurrency thefts this year. Experts warn that a significant heist could easily propel the annual tally past the $1 billion threshold.

The Chainalysis report highlights the troubling connections between DPRK cybercriminals and Russian financial platforms, notably featuring a $22 million transfer from the Harmony Protocol to a questionable Russian exchange. The connection amplifies fears over North Korea’s burgeoning cyber alliances, particularly with Russia, as they both appear to deepen their collaboration in digital crimes.

Governments are struggling under the weight of these cyber-attacks, and companies and retail investors are also bearing the brunt. The month has seen seven major cryptocurrency heists, including a $52 million scam targeting the CoinEx platform and compromises to Stake Wallet, FloorDAO, and Coindroplet.

As the probability of asset recovery from unresponsive Russian exchanges is dismal, these revelations underscore the urgent necessity for a globally coordinated regulatory framework for cryptocurrencies. Amidst growing geopolitical tensions, North Korea’s cyber ventures are not just criminal but also threaten international stability.

By making cybercrime a lucrative enterprise—funds from which possibly fuel its ballistic missile initiatives—North Korea is turning the global cryptocurrency market into an unwitting accomplice. This alarming development warrants immediate action from global governance structures, regulatory authorities, and law enforcement agencies.

The escalation in cybercrimes, backed by an increasingly intricate network of criminals in North Korea and Russia, spells out a pressing issue that cannot be ignored. A multi-billion-dollar problem is ballooning in the digital underworld, demanding unified global countermeasures to stave off greater catastrophe.

The post Russia-DPRK alliance in crypto crime puts the world on high alert first appeared on Coinfea.

This thievery is a fraction of the more than $2 billion plundered by online criminals over the past five years, involving 30 separate assaults on various crypto initiatives. A significant portion of these malicious activities has been directed at decentralized finance (DeFi) platforms, specifically aiming at cross-chain bridges.

The previous year marked a high point for these cyber thieves, with digital currencies worth more than $800 million being stolen. Among the major incidents were three attacks on DeFi platforms, one of which resulted in a $625 million loss from the Ronin Bridge in March. Techniques such as chain hopping and using mixers have been employed by North Korean hackers to launder the ill-gotten gains, followed by rapid conversion into cash via exchanges with lax KYC/AML requirements.

In a notable event in June, the criminals targeted Atomic Wallet users, successfully stealing an estimated $100 million in various digital currencies, including Bitcoin, Ethereum, Tron, XRP, Stellar, Dogecoin, and Litecoin. TRM Labs detailed how the stolen Ethereum was moved to controlled addresses using wrapped Ether (WETH) and then exchanged for wrapped Bitcoin (WBTC), eventually converted to Bitcoin and sent through mixing services to obscure the origin.

Evolving techniques and the importance of robust cybersecurity

The report from TRM Labs also highlights how North Korean hackers have refined their laundering methods on-chain, transitioning from straightforward cryptocurrency exchange usage to intricate, multi-tiered money laundering schemes. This adaptation has come in the face of intensified OFAC sanctions, heightened law enforcement scrutiny, and enhanced tracking abilities. Chain-hopping, where one form of digital asset is changed into another and shifted across various chains, has been a key method employed by hackers to conceal their activities.

TRM Labs stresses the necessity for strong cybersecurity protocols, including the use of hardware security modules for managing cryptographic keys, the whitelisting of addresses to restrict fund transfers to verified recipients, and the utilization of secure, offline storage for keys and passcodes. The responsibility of individual asset protection within the DeFi ecosystem is also accentuated.

The report’s findings bring to light the escalating danger of cybercrime in the realm of cryptocurrency, with a particular emphasis on the DeFi arena. The substantial sums stolen, coupled with the sophisticated methods employed by the criminals, underscore the pressing need for more stringent security protocols and regulatory supervision.

The concentration on DeFi platforms and the continual evolution of laundering strategies demonstrate the cybercriminals’ ability to adapt to regulatory constraints and technological progress.

The post Cybercriminals from North Korea amass over $200 Million in 2023 crypto thefts: TRM Labs analysis first appeared on Coinfea.

The Department of Justice (DOJ) disclosed that the North Korean banker had been charged with unlawful activities related to the cryptocurrency market. The primary reason behind this accusation was that the alleged participated in criminal acts of money laundering.

This highlights the ongoing efforts by authorities to crack down on illicit financial activities and preserve the financial system’s integrity.

U.S. officials announced that the activities in question were allegedly aimed at generating revenue for Kim Jong-Un’s regime. Among those indicted is Sim Hyon Sop, a 39-year-old banker representing the Korea Kwangson Banking Corporation, who has been accused of collaborating with several individuals, including a Chinese national and a Hong Kong British National, of exploiting and stealing funds from cryptocurrency exchanges to benefit North Korea.

According to sources familiar with the case, the accused parties allegedly conspired to steal U.S. Dollars to purchase goods for North Korea, bypassing sanctions imposed by the Treasury Department to hinder the country’s ballistic missile programs.

These allegations showcase the continuing efforts of authorities to prevent illegal financial activities and uphold the sanctity of the financial system.

Additionally, Hyon is accused of conspiring with North Korean Information Technology (I.T.) team to secretly launder the earnings of U.S. citizens employed by dubious blockchain companies operating in the country.

These workers operated under false identities and cunningly requested reimbursement in cryptocurrencies like Tether (USDT) and USD Coin (USDC), which were funnelled to North Korea.

According to the Department of Justice verdict, Sim faces a possible prison sentence of up to 20 years for his alleged involvement in money laundering schemes. Meanwhile, Wu could face up to 5 years in prison for operating an unlicensed money-transmitting business.

The charges against Hyon and Wu illustrate the ongoing efforts of authorities to combat illicit financial activities and maintain the financial system’s integrity.

The post U.S. Government targets money laundering schemes involving North Korea first appeared on Coinfea.