Ripple has started distributing its proprietary threat intelligence regarding North Korean cyber operations to other cryptocurrency companies. This initiative aims to enhance the sector’s ability to detect and respond to attacks originating from internal infiltration rather than exploiting code vulnerabilities.
The information sharing, conducted through Crypto ISAC, follows incidents where malicious actors bypassed technical defenses by embedding themselves within organizations over extended periods. The recent Drift case exemplifies this pattern, where attackers used social engineering to gain trust and access before compromising multisig wallets and siphoning funds without triggering standard alarms.
Security experts note a shift from the 2022-2024 era of DeFi hacks that primarily targeted smart contract flaws. Now, adversaries often pass hiring processes and build credibility within teams, making detection more challenging.
Ripple emphasized that a threat actor rejected by one company frequently applies to multiple others within the same week. Without shared intelligence, these individuals can exploit gaps between firms. The contributed datasets include domains, wallet addresses, and indicators of compromise, enriched with contextual details like LinkedIn profiles, email addresses, and location data.
Erin Plante, Director of Brand Security and Intelligence at Ripple, stated that Crypto ISAC’s updated API enables higher-quality, actionable intelligence to be integrated into security workflows. The API standardizes threat data across Web2 and Web3 systems, allowing real-time responses. Early adopters like Coinbase have already begun implementation.
Meanwhile, legal actions are emerging against entities associated with these threats. An attorney for victims of North Korean terrorism served restraining notices on Arbitrum DAO, claiming that 30,765 ETH frozen after the Kelp exploit constitutes property linked to North Korea. Aave contested this, arguing that stolen assets cannot be lawfully owned by thieves.
Security firms attribute both the Drift and Kelp incidents to the Lazarus Group, with combined losses exceeding $500 million in a single month. Justine Bone, Executive Director of Crypto ISAC, stressed that collaborative intelligence sharing is now essential for robust security, urging firms to act swiftly on shared data as threat actors operate across multiple organizations simultaneously.