Ripple will share North Korea threat intelligence with the cryptocurrency industry to counter long-term social engineering attacks

Deep Tide TechFlow News, May 5th, according to CoinDesk reports, Ripple announced on Monday that it will share its internal intelligence on North Korean hackers with the crypto industry threat intelligence sharing organization Crypto ISAC to help companies identify coordinated infiltration activities.

This move comes amid recent shifts in attack patterns faced by the crypto industry. The April $285 million theft from Drift Protocol was not a traditional smart contract exploit, but rather North Korean hackers spending months building relationships with Drift contributors, implanting malware on their devices, and stealing keys. Ripple stated, “The strongest encryption security posture is a shared posture. Threat actors who haven’t passed background checks at one company will submit resumes to three other companies within the same week. Without shared intelligence, each company starts from zero.”

Ripple will provide Crypto ISAC with data such as LinkedIn profiles, email addresses, locations, and phone numbers, enabling security teams across companies to recognize multiple attempts by the same actor. From 2022 to 2024, DeFi attacks mainly focused on code vulnerabilities, but as security improves, attack methods have shifted from technical exploits to personnel infiltration. Hackers now apply for crypto company jobs, pass background checks, attend video conferences, build trust, and then carry out attacks that are difficult for traditional security tools to detect.

The influence of Lazarus Group has begun reshaping legal procedures. On Monday, a lawyer representing victims of North Korean terrorism delivered a restraining order to Arbitrum DAO, claiming that the 30,765 ETH frozen from the April Kelp cross-chain bridge exploit should be considered North Korean assets under U.S. law enforcement jurisdiction. Aave has filed an objection to this document, stating that “thieves do not legally acquire ownership of property through theft.” The combined losses from the Drift and Kelp incidents exceed $500 million, both publicly attributed to Lazarus Group.