- Ripple shares DPRK-linked hacker intelligence with the crypto industry
- North Korea tied to $577M in crypto thefts already in 2026
- Shift toward long-term social engineering attacks raises new risks
Ripple is taking a different approach to crypto security, and it’s basically saying the quiet part out loud, keeping threat intelligence private hasn’t worked. Instead, the company is now sharing detailed data on North Korean-linked hacking activity with the broader industry through Crypto ISAC.
That includes compromised wallets, malicious domains, and even profiles of operatives posing as remote IT workers, which sounds less like hacking and more like infiltration.
A Pattern That’s Hard to Ignore
The numbers behind this move are… hard to dismiss. North Korean-linked groups have already been tied to around $577 million in crypto thefts in 2026 alone, making up the majority of losses this year.
And this isn’t new behavior either, these groups have been responsible for billions in stolen assets over the past few years, hitting major platforms and protocols with increasing consistency.
The Strategy Has Evolved
What’s changed recently isn’t just the scale, it’s the method. Earlier attacks often relied on technical exploits, but more recent incidents show a shift toward long-term social engineering.
In cases like Drift and KelpDAO, attackers spent weeks, even months, building trust with insiders before executing the actual exploit. That kind of patience makes these attacks much harder to detect and prevent.
When Cybercrime Becomes State Strategy
Security researchers have been increasingly clear about what this represents. These aren’t isolated criminal acts, they’re coordinated operations tied to state-level objectives, with some estimates suggesting a significant portion of funding for North Korea’s programs comes from cyber activity.
That adds a geopolitical layer to what might otherwise look like just another series of hacks.
Sharing Data as a Defensive Move
Ripple’s decision to share intelligence openly is a shift in mindset, treating security as a collective problem rather than a competitive advantage. By distributing real-time data on threats, the hope is that platforms can identify risks earlier and respond faster.
It’s not a complete solution, but it’s probably a necessary step, especially as attacks become more sophisticated.
An Industry-Wide Problem
The bigger takeaway is that this isn’t something any single company can handle alone. The scale, coordination, and persistence of these attacks mean the entire ecosystem has to adapt.
If anything, Ripple’s move highlights that crypto security isn’t just about protecting assets anymore, it’s about dealing with actors that operate on a completely different level of strategy and patience.
