Ripple Shares North Korean Hacker Intelligence with Crypto Industry as Attack Methods Shift to Social Engineering

According to BlockBeats, on May 5, Ripple announced it is sharing internal threat intelligence about North Korean hackers with the crypto industry through Crypto ISAC. The move addresses a fundamental shift in attack methodology: rather than exploiting smart contract code vulnerabilities, threat actors are now deploying social engineering tactics to gain insider access.

In the Drift incident, North Korean hackers spent months establishing trust with a Drift contributor before deploying malware to steal private keys, resulting in a $285 million loss that bypassed all detection systems. Ripple is providing Crypto ISAC with profile data including LinkedIn profiles, email addresses, and contact information to help security teams identify the same threat actors applying to multiple companies. The Kelp exploit, attributed to the Lazarus Group, resulted in $292 million in stolen ETH. Combined, the Drift and Kelp incidents represent over $500 million in losses within a single month linked to the same state-sponsored actor.