North Korea’s Crypto Heists Start on the Open Internet

MalBot · October 30, 2026, 9:30pm

North Korea’s crypto heists end on-chain, but they start on the open internet. The Bybit theft in February 2025 began with one developer. North Korean operators tricked a Safe{Wallet} engineer into running a fake stock-trading project that called out to getstockprice[.]com (Sygnia). About two weeks later, they used that foothold to plant code in the wallet interface Bybit’s signers relied on (Bybit).

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Binance now points to a compromised DevOps engineer’s laptop (BleepingComputer), and North Korean operators have targeted engineers in exactly that role for years. Each of these operations needs a domain before it needs a victim, and Silent Push finds those domains.

After the Bybit theft, we tied bybit-assessment[.]com to a known North Korean operator persona, and the operators registered it hours before the theft. In a separate April 2025 investigation, our analysts exposed three US-registered front companies (BlockNovas, Angeloper Agency and SoftGlide) that North Korean operators used to push malware to crypto developers through fake job interviews. The FBI seized the BlockNovas domain that same week.

As a preemptive cyber defense platform, we turn that staging into Indicators of Future Attack® (IOFA) so defenders can block the lure before anyone opens it. As of October 30, our IOFA feeds list 206 Binance-named domains, every one at our maximum risk score of 100, and at least 64 of them returned live pages in our web scan data this week.

More of our research on North Korean operations

The Silent Push Preemptive Cyber Defense Team has been tracking North Korean infrastructure and personas for years. These are the public write-ups most relevant to the activity above.

Silent Push Exposes North Korean IT Worker Recruiting Facilitators Through Discord Servers, September 2026. We answered a job advertisement on a Discord server and spoke to an operator recruiting people in the US, Europe and Latin America to sit in interviews on a remote worker’s behalf. We assess with high confidence that the operator is North Korean.
How Peer2Profit and Astroproxy Turn Your Bandwidth Into Someone Else’s Product, August 2026. Residential proxy networks are the layer that makes location obfuscation work at scale. We enrolled our own device and watched its IP appear in a commercial proxy pool within about ten minutes, then counted 117,224 unique IPs across three pools over 72 hours.
Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies, April 2025. The BlockNovas, Angeloper and SoftGlide investigation, with the full interview flow, the C2 infrastructure and the malware.
Silent Push Pivots into New Lazarus Group Infrastructure, February 2025. The Bybit research, including bybit-assessment[.]com and the operator persona behind it.
Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors, February 2025. The IP list behind the VPN these operators keep returning to.

Interested in Learning More?

Download our report, Proactively Defending Financial Institutions Against North Korean Remote IT Workers, for the full picture of how these operations are staffed, funded and staged, and what financial institutions can check during hiring and after it.
Book a demo with a Silent Push platform expert to see how North Korean lure infrastructure is flagged in the IOFA feeds before it goes live.
Sign up for the free Silent Push Community Edition and start exploring the datasets today.

Sources

The post North Korea’s Crypto Heists Start on the Open Internet appeared first on Silent Push.

Article Link: North Korea’s Crypto Heists Start on the Open Internet