Solana DEX Stabble told users to withdraw their funds after a former employee was linked to North Korea. TVL fell from $1.75 million to under $663,000, though no exploit has been reported.

Drift Protocol was hacked on April 1, 2026, losing $285 million in minutes as an attacker drained funds using a fake token and manipulated oracles.

North Korean hackers briefly accessed a software developer’s account for Axios and sent malicious updates to thousands of US companies. Experts warn the attack could take months to fully assess and may be part of a long-term effort to steal cryptocurrency.

Bitrefill confirmed a 1 March hack linked to the Lazarus Group after attackers used a compromised employee laptop to access its systems and drain funds. About 18,500 customer records were accessed, but the company said user funds are safe and losses will be covered.

A sophisticated cyberattack compromised Scroll co-founder Ye Chen’s X account, with hackers posing as platform staff to launch phishing campaigns targeting high-profile cryptocurrency figures.

North Korea has set a new records when it comes to crypto theft in 2025, stealing a total of billions through increasingly sophisticated cyber operations that underscore how deeply digital asset crime has become embedded in the regime’s state strategy.

North Korean hackers are using fake video calls and hijacked accounts to trick crypto users into installing malware. The attacks give them full control of devices, allowing them to steal crypto wallets and spread the scam through trusted contacts.

South Korea’s largest crypto exchange, Upbit, has reported a $36 million exploit on the Solana network, a breach that unfolded with unsettling precision on November 27 — the exact date the platform suffered its notorious 2019 hack, when 342,000 ETH were siphoned by North Korea’s Lazarus Group.

The U.S. Department of Justice has intensified its pursuit of North Korea’s state-backed hacking operations, launching a major forfeiture action against $15.1 million in stolen Tether (USDT) while simultaneously securing guilty pleas from five individuals who helped Pyongyang’s operatives embed themselves deep inside America’s corporate infrastructure.

Binance founder Changpeng “CZ” Zhao appears to have become the latest target in what experts describe as a state-backed retaliation campaign by North Korea’s notorious hacking unit, the Lazarus Group.