San Francisco-based enterprise blockchain company Ripple has partnered with the Crypto Information Sharing and Analysis Center (Crypto ISAC) to share threat data concerning North Korean hackers.
The collaboration is meant to protect the industry from a wave of sophisticated attacks.
Threat actors are increasingly infiltrating companies from the “inside out” using trusted access.
A growing threat
The recent hack of the Drift platform has become a major wake-up call for the industry. Malicious actors spent months engaging with Drift contributors to gain their trust before compromising their devices with malicious software. This made it possible for the attackers to compromise multisig wallets and steal funds.
The Lazarus Group was allegedly responsible for a recent attack on the KelpDAO decentralized finance platform that resulted in the theft of $290 million to $292 million. Additionally, the FBI confirmed that North Korea was responsible for a staggering $1.5 billion theft from the Bybit cryptocurrency exchange.
Despite this track record, North Korea has vehemently denied allegations that it is orchestrating this recent wave of crypto hacks.
As reported by U.Today, the “Hermit Kingdom” characterized the allegations as “false information” and “absurd slander” meant to damage Pyongyang’s global image for political purposes.
Ripple’s contribution
Ripple is contributing exclusive DPRK threat intelligence to Crypto ISAC so the industry can act on threats in real-time.
The data shared by Ripple includes domains and wallets associated with fraud, as well as IOCs from active DPRK hacking campaigns.
This intelligence is developed via sophisticated AI-enhanced detection workflows and is contextually enriched. For example, a DPRK IT worker profile shared through the system includes a name, LinkedIn profile, email address, location, contact number, and correlated signals linking them to a broader campaign.
“The strongest security posture in crypto is a shared one,” Ripple noted.
Ripple, Coinbase, and other Founding Members are leveraging this API for direct integration into their security operations.