U.S., Japan, and South Korea Issue Warning on North Korean Cyber Threats to Blockchain Industry

The United States, Japan, and South Korea have warned the global blockchain industry about the increasing cyber threats that North Korean hackers pose.

In a joint statement released on January 14, the nations emphasized the risks posed by groups like the notorious Lazarus Group, which are targeting cryptocurrency exchanges and investors to fund North Korea’s operations.

Hackers used advanced social engineering and malware (TraderTraitor and AppleJeus) to infiltrate systems, prompting blockchain companies to be cautious when hiring IT workers to avoid links to North Korea (DPRK). Governments recommended enhanced public-private collaboration through initiatives like the U.S.-based Crypto-ISAC and similar efforts in Japan and South Korea.

In 2024 alone, North Korean cyber actors were involved in significant thefts, including a $308 million heist from Japan’s DMM Bitcoin exchange, carried out by the North Korean hacking group TraderTraitor. According to the U.S. FBI, the breach began when a hacker posed as a LinkedIn recruiter. This attacker targeted an employee at Ginco, a wallet management service provider for DMM Bitcoin, and shared a malicious Python script disguised as a pre-employment test. When the script was executed, it provided access to Ginco’s systems, resulting in the massive theft.

Research presented at the Cyberwarcon conference in November 2024 revealed alarming tactics by North Korean hackers. As remote IT workers and recruiters, operatives under codenames Sapphire Sleet and Ruby Sleet reportedly stole $10 million in just six months.

Similarly, South Korean authorities confirmed that North Korean hacker groups Lazarus and Andariel were behind the 2019 Upbit cryptocurrency hack, which resulted in 342,000 Ethereum (ETH) thefts. Originally valued at 58 billion won, the stolen Ethereum has since surged to 1.47 trillion won due to rising crypto prices. The National Investigation Headquarters of South Korea’s National Police Agency revealed that the hackers are linked to North Korea’s Reconnaissance General Bureau.

If you want to read more news articles like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.