Ripple is sharing North Korea linked threat intelligence with the crypto industry after a surge in DeFi attacks tied to DPRK hackers.
Key Takeaways
- Ripple is now sharing North Korea linked threat intelligence through Crypto ISAC to strengthen industry defenses.
- DPRK hackers stole $577 million in 2026, making up 76 percent of total crypto hack losses so far.
- Major attacks on Drift Protocol and KelpDAO highlight a shift toward social engineering tactics.
- Security experts warn these attacks reflect a state driven, highly coordinated operation.
What Happened?
Ripple announced it has begun sharing internal threat intelligence on North Korean cyber activity with members of Crypto ISAC. The move comes after a series of high profile DeFi hacks in April that exposed evolving tactics used by DPRK linked groups.
The company said the goal is to help crypto firms detect threats earlier by sharing detailed data such as hacker profiles, wallet addresses, and indicators of compromise.
Big News! 📣 @Ripple is now contributing high-confidence DPRK threat data through Crypto ISAC helping security teams move from awareness to action.
— Crypto ISAC (@Crypto_ISAC) May 4, 2026
The reality is North Korean threat actors aren’t just attacking crypto, they’re infiltrating it.
The latest wave of attacks is… pic.twitter.com/DwdMziEIC1
Ripple Expands Industry Defense With Shared Intelligence
Ripple has taken a collaborative approach by feeding its internal threat intelligence into Crypto ISAC, a not for profit cybersecurity group focused on digital assets. The data includes domains, wallets, and indicators of compromise linked to active North Korean hacking campaigns.
According to Christina Spring, Director of Growth at Crypto ISAC, the intelligence stands out because of its contextual depth. It connects data points such as email addresses, infrastructure, and malware activity, allowing companies to better understand attacker behavior rather than just react to isolated alerts.
Ripple emphasized that security cannot work in silos. The company noted that threat actors often apply to multiple crypto firms after failing background checks at one, making shared intelligence critical to stopping repeat infiltration attempts.
$577 Million in Hacks Signals Growing Threat
Blockchain intelligence firm TRM Labs estimates that North Korean linked hackers have already stolen about $577 million in 2026, accounting for 76 percent of total crypto hack losses so far this year.
Two incidents drove the majority of losses:
- Drift Protocol hack resulted in about $285 million stolen.
- KelpDAO exploit led to roughly $292 million in losses.
These attacks add to a growing pattern. Reports from Chainalysis and TRM Labs show DPRK linked groups stole more than $2 billion in 2025, bringing their total haul above $6.7 billion over the years.
Shift From Code Exploits to Human Targeting
Security experts say the most significant change is not the scale of attacks, but the method.
The Drift incident revealed a long cycle social engineering strategy. Attackers spent months building trust with contributors, attended meetings, and eventually deployed malware to gain access to private keys. When funds were moved, traditional security systems failed to detect anything unusual because the attackers were already inside.
This marks a clear shift from earlier DeFi hacks that focused on exploiting smart contract vulnerabilities. Now, attackers are targeting people instead of code, making detection significantly harder.
Ripple’s shared intelligence includes profiles of suspected North Korean operatives attempting to infiltrate crypto firms. These profiles link identities across multiple companies, helping teams identify repeat actors during hiring processes.
KelpDAO Attack Shows Advanced Coordination
The KelpDAO exploit demonstrated a different but equally complex strategy. Attackers compromised internal systems, disrupted external nodes, and manipulated data feeds to mint unbacked assets.
They then used these assets to borrow large amounts of ETH, moving funds quickly across chains. While part of the stolen funds was frozen by the Arbitrum Security Council, attackers managed to shift remaining assets into Bitcoin using cross chain tools and intermediaries.
The response was swift. Industry participants including Aave supported recovery efforts, while cross protocol coordination helped limit further damage. Legal disputes have also emerged over frozen funds, highlighting the broader impact of these attacks beyond technology.
Experts Warn of State Backed Operations
Security researchers believe these attacks are not random. Natalie Newson, a senior blockchain security researcher at CertiK, said:
The growing activity of groups like Lazarus is raising concerns across the industry, especially as tactics become more sophisticated and persistent.
CoinLaw’s Takeaway
I believe this moment is a turning point for crypto security. In my experience, most companies focus heavily on code audits, but this wave of attacks proves that humans are now the weakest link. What stands out to me is how patient and organized these campaigns have become.
I found Ripple’s decision to share intelligence across the industry not just useful, but necessary. Without collaboration, every company is fighting the same battle alone, and clearly losing. If this model of shared defense works, it could reshape how crypto handles security going forward.
