north

According to Cointelegraph, Mauro Eldritch, the founder of cybersecurity company BCA LTD, and Heiner García, a network threat intelligence analyst at Telefónica Tech, jointly established a fake cryptocurrency startup "Ballena Azul," successfully luring suspected North Korean IT workers to work in a controlled virtual desktop environment for up to five weeks while monitoring their behavior throughout.Investigations show that the external servers used by the workers are linked to North Korean cyber operations that previously distributed malware such as InvisibleFerret, BeaverTail, and OtterCookie; the workers also heavily relied on ChatGPT for programming assistance and Google Gemini to forge identity documents. Researchers pointed out that North Korean IT workers obtained remote jobs by faking U.S. identities, with their earnings ultimately flowing into Pyongyang's weapons of mass destruction programs. According to the U.S. Treasury Department, such programs are expected to generate nearly $800 million for North Korea in 2024.

According to Bitcoin.com, cybersecurity company Genians Security Center has released an analysis report stating that the North Korean Reconnaissance General Bureau's hacker organization Kimsuky is building and testing a set of AI-based cyber attack tools. Researchers found traces of the deployment of three local AI platforms: Ollama, GPT4All, and Msty, as well as components of AI development frameworks such as Microsoft Semantic Kernel and LLaMaSharp in their infrastructure, indicating that the organization is systematically developing dedicated AI attack tools rather than just making temporary attempts.Since early 2026, Kimsuky has been using high-quality documents generated by generative AI for spear-phishing attacks targeting virtual assets, financial investments, and game development. The AI-generated professional documents significantly reduce the effectiveness of traditional phishing email detection. The attack vector is a ZIP archive disguised as a legitimate document, containing a malicious LNK file that, when triggered, can silently execute PowerShell commands in the background.

Cryptocurrency exchange Bybit has filed a civil lawsuit in the United States District Court for the District of Columbia, suing North Korea, the North Korean Reconnaissance General Bureau, and the hacker group Lazarus Group, regarding a theft incident of approximately $1.5 billion in February 2025. Bybit stated that the judge has approved a preliminary injunction prohibiting the transfer or disposal of identified stolen assets during the case proceedings, and believes that Bybit has a high likelihood of success on the merits.The lawsuit also lists unknown individuals and entities holding or transferring the relevant funds as John Doe defendants. Bybit disclosed that approximately $48.4 million has been recovered, and about $30.5 million has been frozen across more than 28 exchanges and custodians, together accounting for approximately 5% of the stolen amount. The attackers transferred about 500,000 ETH from Bybit's cold wallet in February 2025, with most of the funds subsequently exchanged for Bitcoin via Thorchain and transferred through mixing services. Bybit stated that the case is progressing in parallel with a criminal investigation.

Cryptocurrency exchange Bybit has filed a civil lawsuit against the Democratic People's Republic of Korea, its intelligence agency Reconnaissance General Bureau (RGB), and the state-sanctioned hacking organization Lazarus Group, involving a $1.5 billion hacking incident.A U.S. federal court has issued a preliminary injunction prohibiting the transfer or dissipation of identified assets related to the case during the litigation period.

According to Wired, a security researcher who has been infiltrating a North Korean hacking organization for nearly two years has issued a warning, pointing out that the attack methods targeting individual employees and contractors are extremely effective and have a wide-ranging impact, leading to numerous organizations worldwide suffering breaches.Greek cybersecurity researcher Vangelis Stykas stated that since gaining access to the North Korean system 22 months ago, he has found evidence indicating that 1,640 companies in 57 countries have been affected by North Korean hacking operations. Among them, approximately 700 to 800 affected organizations have suffered "highly destructive" breaches.

According to Jinshi reports, several Iranian one-way attack drones attacked and hit a military base in northern Kuwait on Monday night.

According to Jinshi reports, the UK Maritime Trade Operations Office stated that a cargo ship was attacked 20 nautical miles northeast of Haiseb in the Strait of Hormuz.

According to Crypto.news, the hacker organization BlueNoroff, linked to North Korea, uses fake Zoom and Microsoft Teams meetings to analyze cryptocurrency users before deploying malware.The hackers first take control of accounts belonging to trusted contacts in the cryptocurrency industry, then send seemingly normal meeting links via Calendly and other platforms, directing users to counterfeit Zoom/Teams domains. Once users enter the fake meeting page, it quietly scans the wallets in their browsers and decides whether to continue the attack based on the wallet's value. The fake meeting will prompt users to "update Zoom/Teams" or run commands, which actually download malware (supporting Windows and macOS). The malware will steal browser keys, system data, and Telegram sessions.

According to South Korean media Daily NK, North Korean authorities arrested an elite hacker group on July 12, which is suspected of infiltrating the internal networks of the North Korean central bank and foreign trade bank, stealing national trade funds and laundering money through cryptocurrency. Sources say the group's leader is a veteran from the cyber warfare unit under the North Korean Reconnaissance General Bureau, who recruited talented IT graduates from Kim Chaek University of Technology and Pyongyang University of Science and Technology, using encrypted communications and wireless devices to commit crimes.They split the stolen funds into small amounts and transferred them to overseas cryptocurrency wallets, exchanged them for cash through intermediaries, and then converted them into dollars and other currencies in border areas. Pyongyang officials launched an investigation after discovering anomalies in foreign currency payment approvals and records of overseas IP access, ultimately raiding a safe house and arresting suspects who were laundering money, seizing equipment worth hundreds of thousands of dollars. This case has caused a stir among the elite and military circles in Pyongyang, with senior officials in the Reconnaissance General Bureau and the science and education sector worried about being implicated. North Korea has long been accused of stealing billions of dollars in cryptocurrency assets through hacker organizations like the Lazarus Group, but this incident rarely shows that its own financial system has also become a target of internal attacks.

According to Protos, AI shopping agent developer ORO disclosed that it suffered losses of approximately $630,000 due to a suspected North Korean hacker attack. The attackers sent spoofed Microsoft Teams links to ORO employees through a compromised Telegram account, inducing them to install malicious extensions, and after nearly a month of data theft, stole 147,000 Alpha tokens on July 13. ORO is highly confident that the attack originated from the North Korean hacker group Sapphire Sleet.ORO also admitted to security negligence—due to insufficient hardware wallet support in the Bittensor protocol, the company "temporarily" set the owner keys to software wallets, violating its internal principle of prioritizing hardware wallets, which led to the keys being stolen from the compromised computer. ORO stated that it is working with exchanges, law enforcement, and Bittensor ecosystem partners to recover the stolen assets and emphasized that its subnet is operating normally, and other wallets, user data, and validator signing keys were not affected.

According to CoinDesk, a survey by financial technology service provider Broadridge of 200 North American financial services executives shows that 84% of the responding institutions believe that tokenization is of significant importance to their business, indicating that Wall Street is transitioning from the experimental phase of blockchain to preparing for the integration of tokenized assets into everyday market infrastructure.The survey reveals that 68% of respondents believe that tokenization will partially reshape financial markets in the next 3 to 5 years, with nearly one-third of institutions planning to increase their investment in tokenization projects by 26% to 50% or more over the next 2 years. Meanwhile, 92% of institutions expect digital assets and traditional assets to coexist in the foreseeable long term, and 69% plan to integrate tokenization into existing infrastructure rather than building a native on-chain system from scratch.

According to Cointelegraph, Consensys introduced a software developer earlier this year through a "reputable third-party service provider," who was later found to have connections to North Korea. The developer had approximately one month of access to the Consensys system under the alias Tyler Knapp.Consensys General Counsel Matt Corva stated that the developer was not an employee of Consensys but collaborated as a consultant. After discovering the threat, the company immediately terminated access and launched a comprehensive investigation, confirming that no assets or data were stolen, no malicious code was deployed, and user security was not affected. Consensys stated that it would reevaluate its practices regarding outsourcing engineering and development work.

The U.S. CFTC has sued North Carolina man Trevor Vernon and his company Argent Capital Management LLC, accusing them of defrauding approximately 60 investors out of a total of $14 million through a fraudulent commodity pool.According to the complaint filed by the CFTC in the U.S. District Court for the Western District of North Carolina, the commodity pool operated by Vernon and his company involved trading in multiple asset classes, including stock index futures options, stock index futures contracts, and crypto assets. The CFTC stated that Vernon falsely claimed to investors that he was a "successful trader" through quarterly financial updates and monthly performance review emails, while in reality, he was incurring significant losses when trading with investor funds. The regulatory agency indicated that Vernon had accumulated losses of at least $8.6 million in futures, options, and crypto trading. The CFTC stated that the actual trading results were "persistent and catastrophic losses," which were severely inconsistent with the profitability presented to investors.

The Ministry of Interior of Thailand, in conjunction with provincial electricity authorities, police, and local administrative officials, conducted a joint law enforcement operation this Saturday in five provinces: Ubon Ratchathani, Yasothon, Amnat Charoen, Roi Et, and Maha Sarakham, inspecting 14 locations in total. The operation confiscated 315 digital currency mining devices, and investigators found that the individuals involved supplied power to the mining machines by tampering with electricity meters and illegally connecting to the power supply. The total estimated loss reached 40.38 million baht (approximately 1.227 million USD), which includes a 5.38 million baht fine for electricity violations and about 35 million baht in unpaid electricity bills. Relevant evidence has been collected, and authorities have filed lawsuits against the individuals involved.

The leaders of the G7 countries issued a statement at the G7 summit held in Évian-les-Bains, France, once again calling for a joint effort to combat North Korea's cryptocurrency theft and cybercrime. United Nations security researchers have linked North Korea's cryptocurrency theft to the funding of the country's weapons program.Previously, attacks suspected to be related to North Korean hackers included a $285 million attack on Drift Protocol in April and a $36 million breach of Humanity Protocol in June. According to Chainalysis data, North Korean hackers have stolen at least $2 billion in cryptocurrency in 2025, bringing their total historical theft to at least $6.75 billion.

Humanity released an independent investigation report by Quantstamp, which disclosed that in the H token security incident, the attacker used tools and methods characteristic of North Korean hackers, disguising themselves as communication from the Bithumb exchange through phishing emails, inducing project directors to click on malicious attachments, thereby deploying a remote control Trojan on their devices, ultimately gaining full desktop control and wallet private keys. Subsequently, on Ethereum and BNB Chain, they launched on-chain attacks: on the Ethereum side, by stealing keys to upgrade contracts and transferring approximately 141.18 million H tokens, and on the BSC side, by taking over the ProxyAdmin contract and minting new tokens. The stolen assets were then continuously sold on Uniswap and PancakeSwap for about 8 hours, causing significant impact on liquidity and market prices.Currently, the H token contract on the Ethereum side has been frozen, the mainnet bridge remains unaffected, but the BSC deployment has been controlled by the attacker and still has minting permissions. The team is working with exchanges and security parties to advance subsequent disposal and recovery plans, while reminding users to be wary of false "compensation/claim" links, and stated that further progress will be announced through official channels.Previously, the Humanity Protocol was attacked, resulting in the leak of a private key from a member of the Humanity Foundation, leading to over 31 million dollars in funds being stolen.

According to Cryptopolitan, cybersecurity analysts have discovered a new type of fileless remote access trojan (RAT) named RemotePE. It is believed that the cybercrime organization Lazarus Group, associated with North Korea, is using this trojan to attack banks and cryptocurrency companies. The trojan operates entirely in memory, making it difficult for traditional antivirus and forensic tools to detect. Attackers impersonate trading company employees via Telegram, using forged Calendly and Picktime links for social engineering attacks. The malware is loaded in a three-stage chain through DPAPILoader, RemotePELoader, and RemotePE, with the entire process avoiding contact with the file system, utilizing process hollowing, anti-analysis checks, and encrypted C2 communication to evade detection.This malware was first discovered in September 2025. In the first four months of 2026, the Lazarus organization has stolen approximately $577 million in cryptocurrency assets, accounting for 76% of the total global cryptocurrency theft. Since 2017, the organization has accumulated a total theft amount of $6 billion.

According to a report by Cointelegraph, a report released by cybersecurity company CrowdStrike shows that losses from cryptocurrency assets caused by North Korean hackers and threat actors exceeded $2 billion in 2025, a 51% increase year-on-year, despite a decrease in the number of attacks. CrowdStrike stated that North Korean hackers are the largest threat organization targeting cryptocurrency users, and the stolen funds are almost certainly used to finance the regime's military programs.Attackers prioritize high-value targets, mainly focusing on Web3 projects and cryptocurrency exchanges, as stolen funds are easier to cash out and transfer anonymously. In April of this year, the Ethereum Foundation identified 100 North Korean hackers, and the Drift Protocol was infiltrated by North Korean tech workers, resulting in a loss of $280 million, with these threat actors establishing face-to-face relationships through third-party intermediaries.

Web3 security company CertiK has released the "Skynet North Korea Cyber Threat Report." The data shows that since 2016, North Korean hacker groups have plundered approximately $6.75 billion in digital assets. In 2025 alone, the losses from thefts they orchestrated reached as high as $2.06 billion, accounting for nearly 60% of the total losses in the global cryptocurrency industry for the entire year (including the $1.5 billion Bybit theft case). As of early 2026, this threat trend continues, with losses accounting for about 55%.The report emphasizes that the attack patterns of North Korean hackers have undergone a fundamental shift, evolving from simple code vulnerability exploitation to a national-level attack system that combines social engineering, deep supply chain attacks, and "physical infiltration." In the recent Drift protocol incident, attackers even spent six months lurking at offline industry conferences, establishing trust through real funds and interpersonal interactions before executing their attack.CertiK security experts warn that in the face of such systemic attacks, simple technical defenses have become weak. Cryptocurrency institutions urgently need to fully implement a "zero trust" hiring model, strengthen third-party supply chains, establish fund circuit breaker mechanisms, and collaborate with professional security organizations to build a comprehensive lifecycle defense system covering code audits, round-the-clock risk monitoring, and on-chain anti-money laundering/KYT (Know Your Transaction) fund tracking.

U.S. Manhattan Federal Court Judge Margaret Garnett approved Aave's asset recovery plan following the rsETH attack incident, allowing approximately $71 million in ETH that had previously been frozen on Arbitrum to be transferred to a wallet controlled by Aave.Court documents show that this decision modifies a prior injunction against the Arbitrum DAO, allowing the community to complete the ETH transfer through on-chain governance voting, while exempting participants in the voting and execution of the transfer from related legal liabilities. This incident stems from the rsETH attack that occurred in April, which has been widely attributed to the Lazarus Group, linked to North Korea. Previously, lawyers representing the families of North Korean terrorism victims had sought to freeze the related assets and attempted to include them in the compensation for an outstanding judgment of approximately $877 million.The Arbitrum community has shown strong support in a Snapshot temperature check vote for returning the frozen ETH to Aave's recovery plan, but the actual transfer still requires formal approval through on-chain governance. Reports indicate that this case is also part of the U.S. plaintiffs' efforts to recover crypto assets associated with North Korea. In addition to Arbitrum, the plaintiffs had previously sued the privacy protocol Railgun DAO and listed Digital Currency Group (DCG) as one of the defendants, accusing it of participating in related governance and economic activities.