North Korean Infiltration Detected in 1,640 Companies to Steal Cryptocurrencies

• While code theft amounts to millions on the network, violent attacks escalate on the streets.
• North Korean hackers infiltrate companies by posing as remote employees.

Vangelis Stykas, CTO of Kumio, managed to infiltrate the infrastructure of a North Korean cyber-espionage group after a blunder where the attackers infected their own systems. After 22 months of monitoring their Slack and Discord channels, Stykas collected 5 terabytes of internal information.

The leak exposed 1,640 organizations affected globally. Of this group, between 700 and 800 suffered severe breaches that compromised root access on Amazon Web Services (AWS) servers and private keys of cryptocurrency platforms.

What Stykas revealed coincides with a report from Chainalysis confirming that physical violence against cryptocurrency owners has totaled $30 million in the first half of the year, a 37% increase compared to 2023, as reported by CriptoNoticias earlier.

The evidence makes it clear that the cryptocurrency industry faces a multidimensional threat. On one hand, there is the cyber warfare driven by North Korean hackers and the advancement of artificial intelligence to exploit code vulnerabilities; on the other hand, the incursion of organized crime in the physical realm. Shenyang (China) is the main operational support point for North Korean hackers outside their territory, from where they managed the intrusions into the 1,640 companies to steal cryptocurrencies. Source: CriptoNoticias / Created using Gemini.

The Perfect Offer Bait {#h-the-perfect-offer-bait}

According to Stykas, the hunt for vulnerability begins when a developer who provides services to several companies receives an offer via LinkedIn for a new job with an enticing salary. To apply for the position, they download the <> on the same computer they work on daily. The file executes malicious code (malware) on their machine and the hackers steal their corporate passwords and access files to their current clients' servers.

Another method is direct infiltration. This is when the North Korean hacker applies for the job using a false identity. Once hired remotely, the company grants them internal access (Slack, code repositories, servers). From the inside, the hacker infects the corporate network or directly extracts sensitive information and private keys.

Among the victims confirmed by Stykas are Coinbase, Uniswap Labs, Boston Children's Hospital, and the Italian High Council of the Judiciary, along with tech and banking firms from Asia and Europe. The primary target of the hackers is the theft of bitcoin and cryptocurrencies.

The loot ends up in the North Korean nuclear program. The Lazarus group stole $2.020 billion in cryptocurrencies during 2025 (51% more than the previous year). Since 2017, the total exceeds $6.750 billion.

In April 2026 alone, attacks on decentralized financial (DeFi) platforms KelpDAO and Drift Protocol resulted in $577 million in crypto assets being stolen. This money funds ballistic missiles and nuclear tests, circumventing sanctions, as confirmed by investigations.

But the most disturbing finding is that the hackers are hired. They pose as remote employees, receive salaries in the West, attend meetings, and leak intelligence. Stykas summarized it with an uncomfortable question: <<Are you sure that star engineer working from home actually exists?>>.

When brute force replaces phishing {#h-cuando-la-fuerza-bruta-reemplaza-al-phishing}

The <> does not use malicious code. It employs physical force, threats, and deprivation of liberty. The victim hands over the private key or suffers the consequences. The transaction is immediate and irrevocable, and there is no central bank to stop it.

Chainalysis confirms 46 violent incidents in the first half of 2026. If the trend continues, the year will surpass the $58 million recorded in 2025, the highest level reported to date.

Home invasions have increased from 26% to 37% of cases. Kidnappings remain more lucrative (53% of the loot), but breaking into a house is easier than keeping a hostage for days. The chart shows the growing predominance of kidnappings and the increase in home invasions. Source: Chainalysis.

Chainalysis uncovers the trigger for the spike in France. A Treasury official stole and sold in 2024 a database containing the names, exact addresses, phone numbers, and cryptocurrency wallets of the country's top hodlers.

Criminals are believed to have purchased that list and set up surveillance operations. In over 40% of incidents in France, attackers directly threatened the victim's family to force payment.

What the cryptocurrency trail reveals {#h-lo-que-revela-el-rastro-de-las-criptomonedas}

The analysis of the stolen funds reveals three levels of sophistication in processing the loot:

• Opportunists: use centralized cryptocurrency exchanges to liquidate assets, leaving them exposed to easy tracking by authorities.

• Technical attackers: employ bridges between cryptocurrency networks and mixing protocols to fragment and obscure the digital trail of the digital assets.

• Organized crime networks: operate integrated structures that channel assets directly into drug trafficking and international terrorism financing.

This progression confirms that the wrench attack has become an industrialized practice.

Both reports converge on the same warning that cryptocurrency owners are hunted in two dimensions. In the digital and in the physical.

Moreover, both spheres can feed into each other. North Korean hackers possess keys that they could sell to criminal networks; these networks have locations that they could share with state actors. Digital assets are now the perfect loot for both.

The Best Key Is Not Enough {#h-the-best-key-is-not-enough}

For individual holders of crypto assets, hiding wealth is a necessity. The private key of cryptocurrency wallets must not only be protected from hackers, but also from those who know where you live.

For companies, especially those in cryptocurrency, verifying a remote employee is not a Human Resources procedure; it is a matter of national security.

The real paradigm shift does not lie in the sophistication of the tools used, but in the disappearance of defensive borders. When a cyber attack can fund a nuclear program in Asia and the leakage of a database can compromise the physical integrity of a family in Europe, cybersecurity becomes a matter of survival.

Privacy, far from being a privilege or a technical option, is, along with ongoing verification, the only possible line of defense. Tags: Bitcoin (BTC) Hacker Latest Privacy and Anonymity