Compass Investments

Ripple is sharing North Korean threat intelligence with the broader crypto community as recent incidents demonstrate a shift toward more sophisticated social engineering techniques.

Crypto ISAC, a nonprofit focused on crypto security issues, said Tuesday that Ripple is sharing its internal information, including fraudulent domains, wallet addresses and indicators of compromise, related to hacking campaigns from North Korea.

The move follows the high-profile $280 million Drift incident, which Crypto ISAC said was a cold shower for the industry,

as the attack didn’t start with a smart contract vulnerability or technical error. Instead, it began by undermining the trust of Drift users and ultimately compromising their devices.

Companies from both the cryptosphere and traditional financial institutions are increasingly facing these types of sophisticated operations due to threats from the DPRK that are infiltrating from within, said Christina Spring, director of development at Crypto ISAC. This is next-generation social engineering, Spring added.

Ripple also emphasized in X that a threat actor that has not been identified in one organization can quickly target others. Without intelligence sharing, every firm is forced to start from scratch, the company emphasized, adding that sharing information together now allows the industry to respond to threats at a real-time pace.

As part of this initiative, Crypto ISAC announced a new API designed for rapid data dissemination.

the organization pointed out that Ripple, Coinbase and other founding companies are among the first to implement the tool into their security systems. As one of the early adopters, we are working closely with the Crypto ISAC to connect and operationalize new data sources in a way that harmonizes with our internal workflows, Erin Plante, Ripple’s director of brand security and analytics, said in a blog post.

The number of crypto attacks associated with North Korean hacking groups continues to rise. According to a report by TRM Labs, a blockchain analytics company, North Korea’s share of global cryptojacking losses has increased from less than 10 percent in 2020 and 2021 to 64 percent in 2025.

TRM also linked the $292 million Kelp DAO exploit to the TraderTraitor group, allegedly linked to North Korea’s Lazarus.