North Korean cryptocurrency cyberattacks

North Korean-linked cyber activity has targeted various cryptocurrency ecosystems through both financial laundering and large-scale malware distribution.

In late August 2026, blockchain analytics firm Arkham identified that North Korean hackers moved more than $30 million in bitcoin through the decentralized derivatives platform Hyperliquid. This activity highlighted the use of decentralized finance (DeFi) protocols to move funds through pseudonymous channels, prompting increased pressure from the Trump administration to bring such platforms under United States jurisdiction to ensure compliance with anti-money laundering regulations.

By mid-September 2026, reports indicated broader vulnerabilities in digital asset security. A group known as WaterPlum, linked to North Korea, was reported by Japanese and FBI authorities to have infected over 30,000 devices across 100 countries between December 2025 and July 2026. The group utilized fake job offers from impersonated AI and crypto companies to distribute malware, successfully stealing data from approximately 7,000 crypto wallets. Concurrently, South Korean firm D’CENT began investigating unauthorized transfers involving its software-based App Wallet, suggesting that users who manually imported recovery phrases may have exposed assets such as Bitcoin, Ethereum, and XRP.