North Korean Crypto Theft Campaigns Target Developers and Wallet Infrastructure

North Korean operators are using fake projects, recruitment fronts and attacker-controlled internet infrastructure to compromise developers and enable cryptocurrency theft, according to Silent Push. In the February 2025 Bybit theft, a Safe{Wallet} engineer ran a fake stock-trading project, enabling attackers to compromise developer credentials and manipulate the wallet interface used by Bybit’s signers. Bybit’s preliminary forensic review attributed the attack to Lazarus Group and said the compromised Safe environment deceived signers into approving a malicious transaction. Independent investigators Verichains and Sygnia Labs found no indications that Bybit’s own infrastructure had been compromised; the exchange moved most funds out of its Safe-administered addresses on the day of the incident.

Silent Push identified a domain associated with a North Korean operator persona registered hours before the Bybit theft and separately exposed three front companies delivering malware through fake job interviews. As of October 30, it reported 206 Binance-named domains in its threat feeds, at least 64 of which returned live pages that week. The report also cited Binance linking a theft to a compromised DevOps engineer’s laptop, but did not establish North Korean responsibility for that incident. The findings underscore the need to isolate untrusted recruitment projects, protect developer credentials, monitor impersonation infrastructure and verify transaction details independently of wallet interfaces.