Ripple shares North Korean hacker data with crypto industry after $500m in April losses

North Korean hackers stole more than $500 million from crypto firms in a single month. Now Ripple is sharing the intelligence it collected on those attackers with the rest of the industry, names, profiles, email addresses, and the infiltration methods that bypassed conventional security at Drift and Kelp, through the Crypto ISAC network.

The decision comes after a string of high-profile incidents in April, including the $285 million Drift breach, which revealed a shift in attack methods from technical exploits to long-term social engineering campaigns.

The company said the move aims to help crypto firms detect coordinated infiltration efforts earlier, as attackers increasingly bypass traditional defenses. By sharing North Korean threat intelligence, Ripple is attempting to create a unified security posture across the sector, where firms can identify patterns that would otherwise remain isolated.

Recent attacks attributed to North Korean operatives, including the Drift and Kelp exploits, have collectively resulted in losses exceeding $500 million within a single month. These developments have intensified calls for industry-wide collaboration, with North Korean threat intelligence becoming a critical tool in understanding and countering these threats.

Shift from code exploits to social engineering tactics

The Drift breach marked a turning point in how cyberattacks are executed within the crypto ecosystem. Unlike earlier decentralized finance (DeFi) hacks that targeted vulnerabilities in smart contracts, this incident relied on human infiltration.

According to Ripple and Crypto ISAC, attackers spent months building trust with contributors, gaining access to internal systems, and ultimately extracting sensitive credentials. By the time funds were moved, conventional security systems had detected no anomalies.

“The strongest security posture in crypto is a shared one,” — Ripple, in a statement posted on X.

“A threat actor who fails a background check at one company will apply to three more that same week. Without shared intelligence, every company starts from zero.”

This evolution underscores the growing importance of North Korean threat intelligence, as attackers now exploit organizational processes rather than technical flaws. Operatives reportedly apply for roles within crypto firms, pass background checks, and participate in meetings before deploying malware from inside trusted environments.

Ripple’s shared North Korean threat intelligence includes identifiers such as LinkedIn profiles, email addresses, phone numbers, and geographic data. These details allow firms to connect seemingly unrelated incidents and identify repeat actors across multiple organizations.

Industry collaboration centers on North Korean threat intelligence

The integration of Ripple’s North Korean threat intelligence into Crypto ISAC’s network represents a significant step toward coordinated defense. By pooling data, companies can detect patterns of infiltration that would otherwise remain fragmented across the industry.

This collaborative approach is particularly relevant as North Korean-linked groups, including the Lazarus Group, expand their reach. Their activities have evolved beyond opportunistic hacks into sustained campaigns targeting multiple organizations simultaneously.

The broader implication is that North Korean threat intelligence is no longer optional but essential for firms operating in the digital asset space. Without shared visibility, companies risk repeatedly falling victim to the same actors using similar tactics.

At the same time, the effectiveness of this strategy remains uncertain. While intelligence sharing improves detection, it does not guarantee prevention, especially if attackers are already embedded within organizations.

Legal disputes highlight growing impact of North Korean threat intelligence

The influence of North Korean threat intelligence is extending beyond cybersecurity into legal arenas. Following the Kelp exploit, which resulted in the theft of $292 million in ether, legal representatives for victims of North Korean terrorism have initiated efforts to claim frozen assets.

On May 5, an attorney served restraining notices on Arbitrum DAO, arguing that funds linked to the exploit should be treated as North Korean property under U.S. law. The case centers on 30,765 ETH frozen after the attack.

Lending platform Aave has challenged this position, supporting Arbitrum’s stance. “A thief does not gain lawful ownership of stolen property simply by taking it,” — Aave, in a filing backing Arbitrum DAO.

These legal disputes underscore how North Korean threat intelligence is shaping not only defensive strategies but also questions of asset ownership and accountability. The attribution of attacks to state-linked actors introduces new complexities, particularly when determining the legal status of stolen funds.

Outlook: can North Korean threat intelligence curb future attacks?

Despite the growing emphasis on North Korean threat intelligence, questions remain about its ability to slow or prevent future campaigns. The same operatives identified through shared data may already be targeting new firms, exploiting the lag between detection and response.

Ripple’s initiative reflects a broader recognition that the threat landscape has fundamentally changed. As attackers move away from code-based exploits toward human-centered strategies, the role of North Korean threat intelligence will likely continue to expand.

However, the success of this approach depends on widespread adoption and timely information sharing. Without consistent participation across the industry, gaps will persist gaps that sophisticated actors are well-positioned to exploit.

For now, the crypto sector faces a critical test: whether collective defense, powered by actionable North Korean threat intelligence, can keep pace with increasingly adaptive adversaries.