Ripple Opens Threat Intelligence on North Korea-Linked Crypto Attacks

Ripple, Coinbase, and other founding members of Crypto ISAC are among the first to integrate the tool into their security operations.

Ripple News

Ripple has begun sharing its internal threat intelligence on North Korea-linked hacking campaigns with the broader

industry, as attackers shift away from technical exploits toward social engineering operations targeting personnel at crypto firms.

Crypto ISAC, a nonprofit focused on crypto security, announced Tuesday that Ripple is contributing fraud-associated domains, wallet addresses, and indicators of compromise tied to North Korean hacking activity. The data will be made available to industry participants through a newly launched API designed for fast, actionable intelligence sharing. Ripple, Coinbase, and other founding members of Crypto ISAC are among the first to integrate the tool into their security operations.

The initiative follows the $280 million Drift incident, which Crypto ISAC described as a "wakeup call for the industry." The attack did not originate from a smart contract exploit or a code vulnerability. Instead, threat actors spent six months gaining the trust of Drift contributors before compromising their devices.

"Companies in both crypto-native and traditional financial institutions are seeing more of this type of sophisticated operation, linked to North Korean threat actors who are working from the inside out,"