Ripple will share intelligence on North Korean hackers with the cryptocurrency industry to combat the evolving tactics of attacks ranging from code vulnerabilities to social engineering.

BlockBeats News, May 5th, Ripple has indicated that it is currently sharing its internal threat intelligence on North Korean hackers with the cryptocurrency industry. This move has redefined the industry's response to the evolving tactics of North Korean attacks. No one found vulnerabilities or attacked smart contracts. North Korean hackers spent months getting close to a Drift contributor, implanting malware on their device, and exfiltrating keys. When $285 million was transferred, all systems that should have detected the hacker's actions failed to flag any anomalies.

This is the version of the event described by Ripple and the cryptocurrency industry threat intelligence sharing organization Crypto ISAC on Monday, announcing that Ripple is now sharing its internal data on North Korean threat actors with the rest of the industry members. The DeFi hacking spree from 2022 to 2024, which exploited code at its core, saw attackers exploiting smart contract vulnerabilities to drain protocols within minutes. But as security measures tightened, the modus operandi shifted from a technical angle to a human one. Attackers applied for jobs at crypto companies, conducted background checks, appeared on Zoom calls, spent months building trust, and then deployed attacks that traditional security tools could not detect—because the attackers were already inside.

Ripple is now providing Crypto ISAC with profile data that allows this pattern to be identified across companies, including LinkedIn profiles, email addresses, locations, and contact information—this connectivity information enables security teams to identify the candidate they just interviewed, who was the same actor that failed background checks at three other companies last week. Additionally, the Kelp incident, where $292 million worth of ETH was stolen in an attack, has also been publicly attributed to the Lazarus Group actors. This brings the total losses from the Drift and Kelp incidents in April to over $500 million, all linked to the actions of actors from the same country within a one-month timeframe.