North Korean Hackers Target Crypto Firms with Malware, Driving Record $2.1B in H1 2025 Thefts

According to @zachxbt, North Korean hackers are escalating their attacks on the cryptocurrency industry, using a new Python-based malware called PylangGhost disguised in fake job applications. The campaign, attributed to the group Famous Chollima, impersonates major firms like Coinbase and Uniswap to lure crypto professionals into installing the malware, which is designed to steal credentials from over 80 browser extensions, including popular wallets like MetaMask, Phantom, and TronLink, as detailed by Cisco Talos. This activity is part of a larger, alarming trend, with a TRM Labs report indicating that a record $2.1 billion was stolen from crypto platforms in the first half of 2025. North Korean-linked groups are reportedly responsible for $1.6 billion, or 70%, of these losses, highlighting a significant and growing systemic risk for traders and the digital asset ecosystem. The report also notes a strategic shift in attack vectors, with over 80% of stolen funds coming from infrastructure-level breaches like private key theft, which are proving far more lucrative than traditional smart contract exploits.
SourceAnalysis
The cryptocurrency market is currently navigating a complex landscape, balancing significant technological risks against bullish price momentum. A recent investigation highlighted by security researcher zachxbt reveals a sophisticated campaign by North Korean hackers targeting professionals in the crypto industry. According to cybersecurity firm Cisco Talos, a DPRK-aligned group known as Famous Chollima is deploying a new Python-based malware, PylangGhost, disguised within fake job applications for major firms like Coinbase, Robinhood, and Uniswap. This Remote Access Trojan (RAT) is designed to steal critical data from infected Windows systems, including login credentials and private keys from over 80 browser extensions like MetaMask and Phantom. This attack vector represents a persistent and evolving threat, shifting from direct protocol exploits to social engineering attacks aimed at compromising the core infrastructure of the digital asset space.
Record-Breaking Thefts Highlight Systemic Vulnerabilities
The scale of this threat is staggering and underscores a growing crisis in digital asset security. A report from TRM Labs published Friday confirms that the first half of 2025 has been the most damaging six-month period on record for crypto, with over $2.1 billion lost to hacks and exploits across 75 incidents. This figure surpasses the previous high from H1 2022 by about 10%. Alarmingly, North Korean-linked groups are attributed with approximately $1.6 billion, or 70%, of these stolen funds. The colossal $1.5 billion Bybit hack in February, now believed to be the work of North Korea, has skewed the average hack size to $30 million this year, double the previous year's level. This trend marks a critical shift in attack methods. Over 80% of the stolen funds originated from infrastructure-level breaches, such as private key theft, rather than the smart contract vulnerabilities that dominated previous years. This indicates that attackers are successfully targeting the operational weak points of crypto projects and exchanges, a risk that directly impacts traders and their holdings.
Ethereum (ETH) Price Surges Despite Security Headwinds
Despite the grim security backdrop, the market for major cryptocurrencies like Ethereum (ETH) has demonstrated remarkable resilience and bullish strength. In the last 24 hours, the ETHUSDT pair surged by 6.28%, gaining $153.65 to trade at $2,598.47. The price action shows a strong intraday rally from a low of $2,432.82 to a high of $2,615.26. This move suggests that the $2,430-$2,440 zone has established itself as a firm short-term support level. Traders are now watching the $2,615-$2,620 area as the immediate resistance. A decisive break above this level could signal further upside potential, indicating that market participants are currently prioritizing macroeconomic factors or network-specific developments over the persistent threat of sophisticated hacks. The trading volume for ETHUSDT stood at a healthy 545.94 ETH, reflecting solid participation in the upward move.
Broader Market Strength and ETH Outperformance
This positive sentiment is not isolated to Ethereum. Chainlink (LINK) has also posted strong gains, with the LINKUSDT pair climbing 5.82% to $13.81, moving from a 24-hour low of $13.01 to a high of $13.82. This indicates a broad-based appetite for risk among altcoins. More telling, however, is the performance of Ethereum relative to Bitcoin. The ETHBTC trading pair rose by a significant 3.55% to 0.02358 BTC. This outperformance is a key indicator of market sentiment, suggesting that capital is rotating into Ethereum at a faster pace than Bitcoin. This could be driven by anticipation around Ethereum's ecosystem developments or a belief that its potential rewards outweigh its security risks. For traders, the strength in the ETHBTC pair is a crucial signal that could justify overweighting ETH positions relative to BTC in a bullish market scenario. The key challenge remains balancing this clear momentum against the non-trivial tail risk of a major security incident causing a sharp market reversal.
ZachXBT
@zachxbtZachXBT is an Pseudonymous independent on-chain sleuth who is popular on revealing bad actors and scams in the crypto space