Recent Cryptocurrency Cyber Attacks

North Korean attackers reportedly used a convincing fake recruiting process to persuade a Binance software engineer to download a malware-laced coding assignment onto a work computer. The compromise later gave the attackers access to wallet infrastructure and was used in the reported $6.3 billion…

Attackers linked to North Korea allegedly used a fake recruitment process to persuade a Binance software engineer to download a malicious coding assignment onto a work computer. They then used the compromised device, internal AI tooling, and stolen deployment credentials to reach wallet-signing…

North Korean-linked attackers reportedly used a fake job opportunity, multiple interviews, and a malicious coding assignment to compromise a Binance engineer. The scheme built trust over weeks before asking the employee to download an interview file, giving attackers a foothold in the company’s…

Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls.…

Binance says attackers used a fake recruitment process to trick an engineer into downloading a malicious coding assignment onto a work computer. The attackers also used a tampered developer-tool installer and later abused internal access to carry out unauthorized wallet transactions, resulting in…

Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers…

The FBI attributed the theft of roughly $6.3 billion from Binance to North Korea's TraderTraitor operation, which is linked to the Lazarus Group. The reported Binance breach began with a compromised DevOps engineer laptop, while the group has previously used fake job offers and recruitment…

The FBI attributed a record $6.43 billion Binance cryptocurrency theft to the North Korea-linked TraderTraitor group. The group has also targeted people in cybersecurity, AI, blockchain, and recruitment through fake recruiter personas and software-engineering job opportunities, aiming to persuade…

Amatera is a subscription-based information stealer that affiliates distribute through fake AI-tool download pages, compromised websites, paid search ads, phishing, and deceptive ClickFix prompts. The scams convince people to copy and run a command to supposedly fix a CAPTCHA, browser error, or…

Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…

Hackers claimed to have breached crypto swap platform Wagyu.xyz, and researchers reviewed an unverified dataset that allegedly links cryptocurrency trades, Monero wallet addresses and IP addresses. While no follow-on scam has been confirmed, the data could let criminals send highly convincing fake…

ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer…

U.S. authorities sanctioned people supporting a real North Korean scheme that placed workers in legitimate U.S. businesses using false identities and fabricated job applications. The workers reportedly used AI to tailor resumes and cover letters, create profile photos, and even conceal their…

U.S. prosecutors indicted six people over a Madagascar-based scam operation that allegedly stole more than $516,000 from U.S. victims. The group reportedly used dating sites, posed as attractive women, and persuaded victims to connect cryptocurrency wallets to fraudulent NFT websites, then…

Researchers found criminals using World Cup-themed Instagram advertisements, compromised websites, and abandoned analytics tags to expose iPhone users to Coruna and DarkSword spyware kits. The attacks can begin when malicious advertising or web content loads, with little or no action beyond…

Attackers used paid Google ads to direct people to fake Claude download pages hosted on Anthropic’s real claude.ai website. The pages used a ClickFix trick: they told Mac and Windows users to paste a command into their device, installing password- and cryptocurrency-stealing malware. Because the…

ICMacOS is a commercially sold Mac malware kit that uses fake websites to convince victims to paste a command into Terminal. The command installs malware and displays a fake macOS password prompt, putting browser credentials, cloud access, developer secrets, and cryptocurrency wallets at risk. The…

Keystone confirmed that an attacker accessed customer shipping and order information, and a customer reported a social-engineering phone call using those details. The exposed information can make fake support messages and calls about refunds, replacement devices, or order fixes sound credible.…

U.S. authorities allege that Zheng Zhao and co-conspirators used relationship-building scams to persuade at least 174 Americans to invest in fake cryptocurrency platforms. The group contacted victims through social media, dating sites, calls, and text messages, then showed false investment growth…

INTERPOL’s Operation Serengeti III arrested 1,462 suspects across 21 countries targeting fraud, phishing, business email compromise, ransomware, and digital extortion. In Uganda, investigators found scam call centres using prepared scripts and fake trading platforms to persuade people, including…