Ripple Shares North Korean Hacker Intel with Crypto ISAC

Ripple announced Monday that it is sharing exclusive threat intelligence on North Korean-linked hackers with the Crypto Information Sharing and Analysis Center, a nonprofit group facilitating security data exchanges among cryptocurrency firms.

The intelligence, drawn from Ripple's internal investigations, includes fraudulent domains, cryptocurrency wallets, indicators of compromise, and detailed profiles of suspected Democratic People's Republic of Korea operatives. These profiles feature LinkedIn accounts, email addresses, phone numbers, locations, and behavioral patterns linking individuals to broader campaigns. Crypto ISAC members can access the data through a newly launched application programming interface that integrates it into security operations across Web2 and Web3 environments. Coinbase and Ripple are among the early adopters.

The move addresses a tactical shift by North Korean actors, including the Lazarus Group, toward prolonged social engineering rather than smart contract vulnerabilities. In April, attackers compromised Drift Protocol by spending months cultivating relationships with contributors, deploying malware to seize multisig wallet keys, and stealing $285...