Ripple shares DPRK threat data to strengthen crypto sector defense

Ripple shares DPRK threat data to strengthen crypto sector defense
Ripple boosts industry defense by sharing DPRK threat data

​Ripple has begun providing other cryptocurrency companies with detailed internal intelligence on threats linked to North Korean hacking operations, aiming to strengthen collective defenses against increasingly sophisticated attacks.

Highlights

  • Ripple is sharing detailed threat intelligence on North Korean hackers with Crypto ISAC.
  • Attackers are increasingly using social engineering and insider access rather than code exploits.
  • Shared data includes contextual identifiers to speed up detection.
  • Combined losses from recent Lazarus-linked incidents (Drift and Kelp) exceeded $500 million in one month.

Shift in hacker tactics

According to Crypto ISAC, North Korean-linked groups, believed to include the Lazarus Group, have moved away from exploiting smart contract vulnerabilities—the dominant tactic in DeFi hacks between 2022 and 2024—toward long-term social engineering campaigns. 

A notable example is the Drift incident, where attackers spent months building trust within the team, secured employment, and eventually installed malware. This internal access allowed them to compromise multisignature wallets and move funds without triggering standard security alerts.

Ripple’s intelligence sharing initiative

Ripple has shared enriched datasets with Crypto ISAC, including domains, wallet addresses, indicators of compromise, and contextual information such as LinkedIn profiles, email addresses, phone numbers, and location data. These details help connect individuals to coordinated operations across multiple organizations.

Crypto ISAC’s new API standardizes threat data exchange between traditional and blockchain systems, enabling real-time responses. Coinbase is among the first companies to integrate the system.

“The strongest security posture in crypto is a shared one,” Ripple said in a statement. The company noted that attackers often apply to multiple firms in the same week after being rejected by one. 

 

Industry moves toward collective cybersecurity

Ripple’s decision marks a significant shift in how the crypto sector approaches cybersecurity. As state-sponsored hacking groups refine their tactics, sharing intelligence is becoming a critical standard rather than an optional practice. The effectiveness of this model will depend on how quickly companies act on the shared information. 

With attackers operating across multiple targets simultaneously, coordinated defense is emerging as one of the most effective tools to protect the ecosystem.

We also reported that Aave rejects North Korea's link to $71 million in frozen ETH.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.
Weekly Top Bonuses
up to $2,500
deposit bonus for all clients
CLAIM BONUS
Your capital is at risk.