A security researcher who went undercover among North Korean hacking groups has uncovered a staggering 1,640 victims tied to their illicit crypto operations. The findings, released by Bitget, offer an unprecedented look into the mechanics of state-sponsored cybercrime targeting the blockchain industry. This is the first time such a detailed victim count has been linked to these specific threat actors.

The Deep-Dive Investigation

The researcher reportedly embedded themselves within North Korean hacking communities, spending months observing their tactics, infrastructure, and targets. This 'living among' approach provided rare first-hand intelligence about how these groups operate, from initial phishing attempts to final asset liquidation.

According to the report, the 1,640 victims span multiple countries and include both individual crypto investors and institutional players. The scale suggests a highly organized, relentless campaign rather than opportunistic attacks. The researcher noted that many victims were unaware they had been compromised until long after the funds were moved.

Common Attack Vectors Identified

  • Fake job offers and recruiter lures on LinkedIn and Telegram
  • Malicious wallet-drainer apps disguised as legitimate tools
  • Compromised DeFi protocols with hidden backdoors
  • Social engineering via impersonation of known crypto influencers

The report emphasizes that these attacks often involve multiple stages, with initial access gained through seemingly benign interactions. Once inside, the hackers deploy sophisticated tracking-resistant techniques to siphon funds across dozens of wallets.

Who Are the Victims?

The exposed list includes high-net-worth individuals, early-stage project founders, and even employees of major exchanges. While the exact names and amounts remain confidential, the researcher provided aggregated data showing a heavy concentration in Asia and North America.

Interestingly, a portion of the victims were small-scale traders who lost life savings, highlighting that North Korean hackers do not discriminate based on portfolio size. The report urges all crypto users to review their transaction history for any signs of unusual activity, especially those who engaged with unfamiliar job offers or beta-testing opportunities.

How They Get Away With It

North Korean hacking groups, often linked to the Lazarus Group and APT38, have perfected a cycle of theft, laundering, and funding state programs. The researcher's findings suggest they now use mixers and cross-chain bridges more aggressively, making tracing harder for law enforcement.

Moreover, the groups increasingly employ 'chop shops' — intermediaries who convert stolen crypto into fiat or physical goods, severing the on-chain trail. The report also notes a rise in the use of AI-generated phishing content, making scams more convincing than ever.

Key Red Flags for Crypto Users

  • Unsolicited job offers with high pay for simple tasks
  • Requests to download unreleased or beta software
  • Links to fake trading platforms that mimic real ones
  • Pressure to move funds to a 'secure' wallet provided by a stranger

The researcher advises enabling hardware wallet usage for large holdings and never sharing seed phrases, even with supposed exchange support. Regular security audits of smart contract interactions are also recommended for DeFi users.

Industry Response and Next Steps

Bitget's report calls for greater collaboration between exchanges, blockchain analytics firms, and government agencies to disrupt these networks. Several exchanges have already added blacklisted addresses to their monitoring systems, but the sheer volume of new wallets makes full prevention difficult.

The researcher plans to publish a full technical dossier in the coming weeks, which may include specific wallet addresses and infrastructure domains. Until then, the crypto community is urged to stay vigilant and report any suspicious activity to relevant authorities.

This investigation serves as a wake-up call: North Korean hackers are not distant folklore but an active, pervasive threat. With 1,640 confirmed victims, the scale of their operations demands immediate attention from every participant in the digital asset space.

Key Takeaways

  • 1,640 confirmed victims linked to North Korean hacking groups, per new research
  • Attack methods include fake jobs, malicious apps, and compromised DeFi protocols
  • Victims range from retail traders to institutional players globally
  • Advanced laundering techniques make funds nearly impossible to recover
  • Users should adopt hardware wallets and double-check all unsolicited communications

As the crypto industry matures, so do its adversaries. Staying informed is the first line of defense against these sophisticated state-sponsored attacks.