The tweet was deleted by the author.
But we saved everything 🙂.
Ripple has begun providing other cryptocurrency companies with detailed internal intelligence on threats linked to North Korean hacking operations, aiming to strengthen collective defenses against increasingly sophisticated attacks.
According to Crypto ISAC, North Korean-linked groups, believed to include the Lazarus Group, have moved away from exploiting smart contract vulnerabilities—the dominant tactic in DeFi hacks between 2022 and 2024—toward long-term social engineering campaigns.
A notable example is the Drift incident, where attackers spent months building trust within the team, secured employment, and eventually installed malware. This internal access allowed them to compromise multisignature wallets and move funds without triggering standard security alerts.
Ripple has shared enriched datasets with Crypto ISAC, including domains, wallet addresses, indicators of compromise, and contextual information such as LinkedIn profiles, email addresses, phone numbers, and location data. These details help connect individuals to coordinated operations across multiple organizations.
Crypto ISAC’s new API standardizes threat data exchange between traditional and blockchain systems, enabling real-time responses. Coinbase is among the first companies to integrate the system.
“The strongest security posture in crypto is a shared one,” Ripple said in a statement. The company noted that attackers often apply to multiple firms in the same week after being rejected by one.
Ripple’s decision marks a significant shift in how the crypto sector approaches cybersecurity. As state-sponsored hacking groups refine their tactics, sharing intelligence is becoming a critical standard rather than an optional practice. The effectiveness of this model will depend on how quickly companies act on the shared information.
With attackers operating across multiple targets simultaneously, coordinated defense is emerging as one of the most effective tools to protect the ecosystem.
We also reported that Aave rejects North Korea's link to $71 million in frozen ETH.