DPRK-Linked Operators Escalate Crypto Targeting Campaign with AI-Enhanced Social Engineering

DPRK-linked groups intensify crypto theft and laundering via AI-driven social engineering and fake projects, following Bybit’s hack and FBI confirmation.

Rich by Coin

2026-02-23

Bybit hack marked an escalation in DPRK-linked theft operations. Elliptic first attributed the attack to DPRK actors, a finding later confirmed by the FBI. The incident involved laundering tactics including refund addresses, worthless tokens, and diversification across mixing services. DPRK hackers stole a record $2 billion in cryptoassets throughout 2025, pushing their cumulative total past $6 billion.

Activity accelerated in 2026, with Elliptic recording twice as many exploits in January as in the prior year. Social engineering is the primary attack vector across these incidents, despite the technical exploits that follow. Two ongoing campaigns, DangerousPassword and Contagious Interview, have netted $37.5 million since January 1, 2026.

DangerousPassword hijacks compromised social media accounts to contact targets, prompting victims to join Zoom or Teams calls where fake audio errors lead them to run command-line malware. Contagious Interview fabricates job offers, directing targets to trusted code repositories that host malware. Execution deploys similar key-stealing tools. Both campaigns risk compromising the organization if victims use employer devices.

DPRK IT workers infiltrate crypto projects patiently, using fake identities, cloned accounts, rented laptops for location spoofing, and accomplice networks. Salaries provide direct revenue, but the real goal often involves backdoors, persistent access, or developer-machine compromises in remote-first environments.

The Tenexium incident—where Tenexium.io, a decentralized margin trading protocol in the Bittensor ecosystem, went offline on January 1, 2026 with $2.5 million drained from its treasury—illustrates the evolution toward fake projects. Blockchain analysis has flagged DPRK-linked contributors and laundering patterns across cross-chain activity and centralized cashouts, suggesting a shift from infiltration to project creation.

DPRK-linked actors have intensified efforts in 2025–26, with laundering and manipulation tactics extending across multiple crypto networks and platforms. Crypto firms are advised to screen for social-engineering red flags, vet remote hires rigorously, and apply blockchain analytics across 60+ chains to trace tainted funds. Elliptic’s laundering-visualization tools support blocking DPRK-linked assets.