North Korean Hackers Breach 1,640 Global Firms, Impacting Crypto Sector

A specialized investigation into North Korean cyber operations has revealed that state-backed actors successfully infiltrated 1,640 companies across 57 countries. According to findings shared by cybersecurity researcher Vangelis Stykas, who maintained covert access to the attackers' infrastructure for 22 months, the scale of the campaign is significantly broader than previously estimated. The report indicates that between 700 and 800 organizations suffered "extremely destructive" intrusions, with a heavy emphasis on targeting individual employees and contractors to bypass traditional corporate security perimeters.

Social Engineering and Remote Work Exploitation

The investigation highlights that North Korean hacking units, including those associated with the Lazarus Group, have increasingly shifted their focus toward social engineering. By posing as legitimate recruiters or technical contractors, these actors secure access to sensitive internal systems. This strategy has proven particularly effective in the blockchain and fintech sectors, where remote work is prevalent.

• The hackers utilized spear-phishing campaigns via platforms like LinkedIn and Telegram.
• Malicious document attachments and exploits against unpatched software were used to establish persistent backdoors.
• Attacks often targeted IT contractors to gain lateral movement within larger corporate networks.

In June 2026, reports from firms like CrowdStrike suggested that North Korean-backed units accounted for nearly half of all state-sponsored attacks on technology companies, often stealing cryptocurrency from blockchain developers after securing remote roles.

Financial Impact and the Cryptocurrency Connection

The primary objective of these wide-ranging infiltrations remains the generation of illicit revenue to circumvent international sanctions. Data from early 2026 suggests that North Korea-linked hackers were responsible for approximately 76% of all cryptocurrency theft recorded in the first quarter of the year. Notable incidents linked to these actors include the exploitation of DeFi protocols and large-scale exchange breaches, such as the $1.5 billion theft from a major trading platform earlier in 2025.

"This isn’t random hacking; the pace of activity makes it more comparable to a state-run financial operation than a conventional threat group", noted Natalie Newson, a senior blockchain security researcher at CertiK, regarding the sophisticated methods used to drain financial accounts.

The findings presented at the Black Hat security conference in Las Vegas underscore a growing trend where attackers deploy "memory-only" malware and custom binaries for Apple environments to evade standard antivirus detection. These tools allow them to exfiltrate data and manipulate transactions in real-time while remaining undetected for months.

The revelation of over 1,600 breached entities serves as a critical warning for the global digital asset industry. As state-sponsored actors refine their ability to pose as trusted employees, the reliance on traditional identity verification is becoming insufficient. Experts recommend that organizations in the Web3 and cryptocurrency space implement rigorous multi-factor authentication (MFA) and hardware-based security keys to mitigate the risk of account takeovers originating from sophisticated social engineering campaigns.