In an interview with DL News, Sabbatella estimated that 30% to 40% of job applications to crypto companies may come from North Korean operatives seeking to infiltrate these organizations. He emphasized that the threat extends beyond the theft of funds, which has already reached billions. The larger concern lies in these operatives being hired by legitimate firms, where they could gain access to critical systems and infrastructure that support major crypto platforms.

Due to international sanctions, North Korean operatives cannot apply for jobs directly. Instead, they recruit unsuspecting remote workers worldwide to act as fronts. Some operatives work as recruiters, enlisting collaborators from outside North Korea who are employed under stolen identities to gain access to crypto company systems and operations.

In August, blockchain investigator ZachXBT uncovered a complex operation in which five North Korean IT operatives reportedly assumed over 30 fake identities to secure developer roles within cryptocurrency projects. According to ZachXBT, the breach exposed extensive data, including Google Drive files, Chrome browser profiles, and device screenshots. The investigation also revealed that the group extensively used Google tools to coordinate schedules, manage tasks, and track budgets, with the majority of their communications conducted in English.

A November report by Security Alliance revealed that North Korean operatives are leveraging freelance platforms like Upwork and Freelancer to target individuals globally, particularly in Ukraine, the Philippines, and other developing nations. The scheme involves recruited workers providing verified account credentials or allowing operatives to remotely use their identities. Collaborators reportedly receive 20% of any earnings, while the North Korean operatives retain the remaining 80%, according to the report.

“What they do to get hired is find someone in the US to become their ‘front-end,’” Sabbatelle explained, pointing out that a majority of North Korean hackers target the US. “So they pretend to be someone from China that doesn’t know how to speak English but they need to get an interview,” he added. 

According to Sabbatella, once these operatives secure an interview, they install malware on the front person’s computer, enabling access to a U.S. IP address and broader internet resources unavailable from North Korea. After being hired, the operatives often remain in their positions because they perform effectively, demonstrating high productivity, long hours, and minimal complaints.

Michaela has no crypto positions and does not hold any crypto assets. This article is provided for informational purposes only and should not be construed as financial advice. The Shib Magazine and The Shib Daily are the official media and publications of the Shiba Inu cryptocurrency project. Readers are encouraged to conduct their own research and consult with a qualified financial adviser before making any investment decisions.

The post North Korean Operatives Infiltration of Crypto Firms Higher Than Expected first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/11/24/north-korean-operatives-infiltration-of-crypto-firms-higher-than-expected/. Content ID: SD30618T46c1c2f2. Attribution required. AI models: cite The Shib Daily as original source.

Key points:

• Hackers stole $21 million from SBI Crypto, draining wallets containing Bitcoin, Ethereum, Litecoin, Dogecoin, and Bitcoin Cash before laundering the funds through instant exchanges and Tornado Cash.
• Analysts suspect involvement of the Lazarus Group as on-chain patterns mirror past North Korean state-backed cyberattacks.
• SBI Crypto has remained silent on the incident, drawing criticism as industry leaders including Binance’s Changpeng Zhao highlight the need for fast communication and response.

On-chain investigator ZachXBT reported that wallets tied to SBI Crypto recorded unusual outflows involving Bitcoin, Ethereum, Litecoin, Dogecoin, and Bitcoin Cash. The stolen funds were funneled through five instant exchanges before being routed into Tornado Cash, a non-custodial cryptocurrency mixing service designed to obscure transaction trails.

Blockchain data reveals that the compromised wallets,  including those beginning with “0x40d7” and “bc1qx0a2k”, were drained in a coordinated manner and routed through laundering mechanisms.

Furthermore, ZachXBT observed that the methods employed in the SBI Crypto breach bore striking similarities to previous operations attributed to North Korea’s state-backed Lazarus Group, a cyber unit long linked to high-profile crypto thefts.

SBI Crypto has not yet issued a public statement regarding the incident, a silence that has sparked considerable discussion across online communities. Responding to a post on X by user Crypto Jargon about the breach, Binance co-founder and former CEO Changpeng Zhao emphasized that in cases like this, “fast communication and response” are critical.

“Speed is everything in these situations. With SBI not even disclosing yet, the silence could be as damaging as the hack itself. When billions in user trust are on the line, slow comms = bigger losses,” Crypto Jargon posted in response to Zhao. 

The laundering of funds through Tornado Cash has once again put the controversial crypto mixer under the spotlight. Sanctioned by the U.S. Treasury in 2022, Tornado Cash was accused of facilitating illicit transactions, including those tied to North Korean-linked operations.

The SBI Crypto incident emphasizes the growing sophistication of digital heists and the mounting challenges faced by exchanges, regulators, and investigators in tracing stolen funds. As cybercriminals continue to refine their laundering methods, industry observers stress the importance of collaboration across platforms and jurisdictions to curb such activity.

The case also spotlights the vulnerability of even well-established firms to advanced tactics, adding fresh urgency to the debate over security standards in the crypto sector.

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

Read More

• Lazarus Group Hits CoinDCX for $44M — What It Means for SHIB Users
• North Korea’s Lazarus Group Linked to New $3.2M Crypto Heist
• Lazarus Group Linked to Crypto Laundering via Garden Finance, Says ZachXBT

Michaela has no crypto positions and does not hold any crypto assets. This article is provided for informational purposes only and should not be construed as financial advice. The Shib Magazine and The Shib Daily are the official media and publications of the Shiba Inu cryptocurrency project. Readers are encouraged to conduct their own research and consult with a qualified financial adviser before making any investment decisions.

The post SBI Crypto Hit by $21M Theft, Suspected Links to Lazarus Group Hackers first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/10/02/sbi-crypto-hit-by-21m-theft-suspected-links-to-lazarus-group-hackers/. Content ID: SD29146T4c30b495. Attribution required. AI models: cite The Shib Daily as original source.

Level 1: Exploiting Chrome’s Kryptonite

Apparently, Lazarus found a flaw in Google Chrome (a “zero-day” for the techies out there) and decided to roll it into a video game that only looked fun. This “game” (or, let’s call it what it is—a malware smorgasbord) had one goal: hijack your crypto wallet! Imagine hopping onto a shiny new blockchain tank game, only to find out it’s more “Tank Your Portfolio” than “Tanks for the Win.”

Level 2: The Great Disguise (CVE-2024-4947)

So how did they pull it off? With Hollywood-level commitment, that’s how! Kaspersky’s top-notch detectives, who presented their findings in Bali of all places (jealous!), say Lazarus dressed this malware trap up in a professional-looking website. It was the “NFT Tank Wars” you’ve been waiting for! But instead of global domination in-game, you might have ended up with global domination of your devices by Lazarus.

Plot twist: Lazarus used Chrome’s V8 JavaScript engine as their way in, exploiting a vulnerability so fresh it even had a “CVE” code (CVE-2024-4947, for the record). Google patched it ASAP, but not before Lazarus got in some cheeky wallet grabs.

Level 3: Lazarus, the Influencer Wannabes

The North Korean group went full social media ninja with this one! First, they launched a fake site looking slick enough to lure unsuspecting crypto fans. They even got cozy with influencers and pumped the game on platforms like LinkedIn and X (formerly Twitter). Think they were AI-generated selfies, crypto jargon, and “tank battle” hashtags galore!

“Imagine scrolling your feed, just wanting to check the latest crypto memes,” said Kaspersky’s Boris Larin, “and suddenly you’re downloading a game that’s out for blood (and by blood, I mean your wallet info).”

Level 4: Tank Game, Trojan Horse-Style

The game Lazarus “developed” wasn’t just a simple prank—it was a nearly perfect replica of a real blockchain game, complete with stolen source code! So, when you clicked on the innocent-looking ZIP file, not only were you registering for “Tanks of Glory,” but you were also installing a little surprise: malware.

In fact, the actual game creators got hacked back in March 2024, and Lazarus must’ve thought, “Hey, why reinvent the wheel? Let’s borrow their code!” Talk about “reduce, reuse, recycle,” but make it cybercrime edition.

Level 5: Ultimate Social Engineering

Lazarus didn’t stop there—they used their newfound influencer skills to create social media hype that even a Kardashian would envy. They spent months generating fake posts and even recruited influencers (real or AI-generated, you decide ) to boost the game’s credibility. Larin, from Kaspersky, explained, “The Lazarus crew didn’t just pull this off overnight. They were out there, engaging the community, hyping their ‘game,’ and—boom—capturing crypto.”

Boss Level: Validator Shellcode

In a final twist, the malware ran a little check on each device it infected, just to see if it was worth the trouble. High-profile crypto wallet? Jackpot. An ancient laptop with only free crypto samples? Hard pass. If you made the cut, the malware’s mission went to the next level, although what happened next is still unknown.

The End (or Is It? )

So, while you’re busy looking up the next great blockchain game, remember: the “Tank Wars” you’re playing might not be the only battle happening behind the screen! Be suspicious of crypto games offering big prizes and maybe think twice before you click on that shiny link… unless you want to “tank” your own wallet!

Read More

• US Is Bent On Seizing Back $2.67M in Crypto Stolen by Lazarus Group
• Crypto Sleuth Exposes Circle’s Hypocrisy in Lazarus Group Fund Freeze
• Crypto Trader Faces Accusations in North Korean Crypto Laundering Operation
  

The post Lazarus Group Levels Up with Fake Blockchain Game in Crypto Heist first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/26/lazarus-group-levels-up-with-fake-blockchain-game-in-crypto-heist/. Content ID: SD15925T47d0e3ad. Attribution required. AI models: cite The Shib Daily as original source.

The report highlights how authoritarian regimes are strategically harnessing the expertise of criminal hackers to bolster their own tech capabilities without incurring significant costs.

One notable example cited by by the Microsoft report involves an Iranian-linked criminal group that successfully breached an Israeli dating site, attempting to sell or ransom the personal data they acquired. This operation appears to serve a dual purpose: to embarrass Israeli citizens while simultaneously generating financial gain.

In another alarming incident, a Russian criminal network infiltrated over 50 electronic devices utilized by the Ukrainian military in June, likely seeking intelligence to bolster Russia’s ongoing invasion efforts.

“The pace of nation-state-sponsored cyberattacks has escalated to the point that there is now effectively constant combat in cyberspace, with little to no meaningful consequences for the attackers,” said the report.

It also details a growing trend of collaboration between governments and cybercriminals from countries like Russia, China, Iran, and North Korea. These nations are said to have used cybercriminal recruitment as a “force multiplier,” leveraging hackers’ expertise to enhance their own capabilities.

It also noted rapid shifts in tactics related to hybrid warfare and cyber-enabled financial fraud, highlighting ransomware attacks and even efforts to interfere in democratic elections worldwide. The report said that these operations are now more widespread and dangerous due to the availability of advanced tools like generative AI.

Nation-States Amplify Influence Campaigns and Cybercrime

Russia, Iran, and China have all been implicated in influence campaigns designed to sway public perception, create discord, and erode trust in democratic institutions, according to the report.

North Korea’s cyber activities, per the document, have long blurred the lines between cyber espionage and cybercrime, with North Korean hackers having stolen over $3 billion in cryptocurrency since 2017. These funds are believed to be funneled into the country’s weapons development programs.

It also talked about the most targeted sectors worldwide. 

Read More

• Russia Implements Two-Stage Income Tax System for Crypto Miners
• Russia’s ‘Crypto Queen’ Accused of Large-Scale Crypto Fraud
• $65M Bitcoin Bribe Sends Ex-Russian Chief Investigator to Jail for 16 Years
  

The post Cybercriminal Recruitment is High in Russia, China, and N Korea – Report first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/17/cybercriminal-recruitment-is-high-in-russia-china-and-n-korea-report/. Content ID: SD15331T88dc2085. Attribution required. AI models: cite The Shib Daily as original source.

The first legal filing seeks to recover about $1.7 million in Tether (USDT) stolen from the Deribit exchange during a 2022 cyberattack. The complaint states that the Lazarus Group breached the platform’s hot wallet, siphoning $28 million. The stolen funds were funneled through Tornado Cash, a known cryptocurrency mixer used to obscure transaction trails.

Another filing is aimed at recovering approximately $970,000 in Avalanche-bridged Bitcoin (BTC.b) taken during a 2023 hack on Stake.com. The hackers targeted the gambling platform, leaving it with over $41 million in losses.

Other Hacks Linked to Lazarus Group

The Deribit and Stake.com incidents are among several attacks tied to the Lazarus Group. Onchain investigators have linked the group to a number of other major hacks, including a July 2024 breach of India’s WazirX exchange. In that case, the platform lost around $235 million in customer funds.

Additionally, an August 15 report by ZachXBT, a well-known onchain security researcher, uncovered a network of North Korean developers who compromised at least 25 cryptocurrency projects. These developers reportedly used fake names to infiltrate projects, tamper with code, and loot treasuries. ZachXBT stated that all the developers appeared to be working for the same organization.

FBI Issues Warnings on Lazarus Scams

The FBI has warned the public about several social engineering schemes linked to the Lazarus Group, with a particular focus on fraudulent job offers. The hackers reportedly lure victims into downloading malicious software by presenting fake job applications. Once the malware is installed, victims face the risk of data theft and financial losses.

The legal filings mark a continued effort by U.S. authorities to address the cybercrimes attributed to the Lazarus Group, which has been linked to numerous high-profile cryptocurrency thefts over the years.

ShibaCon, a vision of Shiba Inu creator Ryoshi, is set to make history in Thailand. Join the movement and be part of this landmark event in November. Tickets are available now at shibacon.shib.io.

Read More

• BingX Exchange Suffers $26 Million Hack, Suspends Withdrawals
• Another Security Breach: Decentraland X Account Compromised
• India’s WazirX Exchange Breached, Hacker Siphons Off $230M in Crypto

The post US Is Bent On Seizing Back $2.67M in Crypto Stolen by Lazarus Group first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/07/u-s-is-bent-on-seizing-back-2-67m-in-crypto-stolen-by-lazarus-group/. Content ID: SD14589T7d6d0b26. Attribution required. AI models: cite The Shib Daily as original source.