2026-03
On March 2, 2026, DPRK-linked operators compromised four Neutralinojs GitHub repositories using the stolen alphagamer7 contributor account. The attacker force-pushed backdated malicious commits in a 132-second window, hid obfuscated JavaScript payloads in…
🇱🇰 Sri Lanka
#SupplyChain
#Technology
2026-03
Bitrefill experienced a cyberattack beginning around early March 2026, which was traced back to a compromised employee device that exposed internal credentials. Using this access, attackers infiltrated the company’s systems and were able to drain funds fr…
🇸🇪 Sweden
#Cryptocurrency
#FinancialGain
#DataBreach
2026-02
Reporting from Symantec, Carbon Black, and later technical analyses linked Lazarus activity to Medusa ransomware operations, including an unsuccessful intrusion against a U.S. healthcare organization and activity against a Middle East target. The observed…
🇺🇸 United States
#Healthcare
#FinancialGain
2026-01
The Step Finance incident was not caused by a smart contract flaw but by a compromised executive laptop that exposed administrative keys, allowing an attacker to transfer staking authority to a new wallet and unstake 261,854 SOL (approximately $27.3 milli…
🇪🇸 Spain
#Cryptocurrency
#Suspicious
#FinancialGain
2025-09
On September 24, 2025, SBI Crypto, a mining-pool subsidiary of Japan’s SBI Group, suffered suspicious unauthorized outflows totaling roughly $21 million to $24 million across Bitcoin, Ethereum, Litecoin, Dogecoin, and Bitcoin Cash wallets. Funds were rout…
🇯🇵 Japan
#Cryptocurrency
#FinancialGain
2025-09
On September 24, 2025, Seedify reported that a DPRK state-affiliated Web3 hacking group gained access to a developer’s private key at about 12:05 UTC and abused minting privileges. The attacker modified OFT contract settings, minted unauthorized SFUND tok…
🇸🇨 Seychelles
#Cryptocurrency
#FinancialGain
2025-08
On August 14, 2025, BTCTurk suffered a major security breach with approximately $51.7 million drained from its hot wallets across seven blockchains—including ETH, AVAX, ARB, Base, OP, MANTLE and MATIC—following a private key leak.
🇹🇷 Türkiye
#Cryptocurrency
#FinancialGain
2025-08
S2W TALON attributed a South Korea-focused postal-code update lure campaign to ChinopuNK, a ScarCruft subgroup, with malicious LNK files in RAR archives dropping an AutoIt loader and retrieving follow-on payloads from external infrastructure. The payload …
#FinancialGain
2025-07
On July 24, 2025, WOO X suffered a cryptocurrency-theft incident attributed by the exchange to suspected North Korea-linked activity. A developer ran a malicious open-source collaboration project on a company MacBook, giving the actor access through a com…
🇺🇸 United States
#Cryptocurrency
#FinancialGain
2025-07
In July 2025, Indian cryptocurrency exchange CoinDCX suffered a compromise of an internal operational account used for liquidity provisioning on a partner exchange. Linked reporting put exposure at about $44 million to $44.3 million, while CoinDCX said cu…
🇮🇳 India
#Cryptocurrency
#FinancialGain
2025-07
On July 16, 2025, cryptocurrency exchange BigONE suffered a third-party attack on its hot wallet, resulting in an estimated loss of about $27 million across multiple assets including BTC, ETH, USDT, SOL, DOGE, and SHIB. The attack path was quickly identif…
🇸🇨 Seychelles
#Cryptocurrency
#FinancialGain
2025-06
On June 25, 2025, Favrr’s FAVRR token DEX listing was exploited, with blockchain analysis estimating more than $680,000 stolen from the Web3 project. The analysis linked the loss to payroll and wallet flows involving suspected DPRK IT workers hired as dev…
🇬🇮 Gibraltar
#Cryptocurrency
#FinancialGain
2025-06
On June 18 and June 23, 2025, Matt Furie and ChainSaw-linked NFT projects including Replicandy, Peplicator, Hedz, and Zogz were exploited after contract ownership was transferred to attacker-controlled wallet 0x9Fca. The attacker unpaused mints, minted NF…
🇦🇺 Australia
#Cryptocurrency
#FinancialGain
2025-05
On May 9, 2025, Taiwan-based BitoPro suffered a cryptocurrency theft that forensic findings later said resembled Lazarus Group tradecraft. Attackers socially engineered a cloud operations employee, implanted malware, hijacked AWS session tokens to bypass …
🇹🇼 Taiwan
#Cryptocurrency
#FinancialGain
2025-05
On May 9, 2025, LNDfi suffered a \$1.27 million security breach caused by a rogue developer—later identified as an undercover North Korean IT worker—who gained unauthorized access to admin keys and drained the protocol. The attacker deployed altered smart…
#Cryptocurrency
#FinancialGain