Lazarus Group

Bitget has confirmed approximately $351.6 million in unauthorized transfers from portions of its wallet infrastructure after detecting abnormal activity at 18:31 UTC on September 24. The exchange said the $351.6 million incident was contained to parts of its hot and warm wallet layers under a three-tier custody system. Its cold wallets were not affected. Bitget activated its emergency response process within minutes, identified and flagged addresses connected to the transfers and notified law-enforcement agencies and onchain security firms. Withdrawals Paused…

Wallets linked to North Korea’s Lazarus Group moved more than $30 million through Hyperliquid over the past three weeks, with activity continuing through August 31 as the onchain derivatives platform moves closer to a potential regulated U.S. entry. More than $30 million passed through the identified wallet cluster using Hyperliquid’s HyperUnit infrastructure. The addresses had previously been connected to Lazarus by ZachXBT in 2024 through activity involving about $61 million in stolen funds. Bitcoin Moves Into ETH and SOL Before…

North Korea-linked hacking group BlueNoroff is using fake Zoom and Microsoft Teams meetings to identify cryptocurrency wallets before choosing which victims receive malware. JUMPSEC recovered the source code behind an active phishing kit after its operators left JavaScript source maps exposed on live infrastructure. The files revealed an operator-controlled system combining hijacked Telegram accounts, fake meeting pages, wallet reconnaissance and malware delivery. The campaign begins when a compromised Telegram account belonging to a genuine industry contact sends a meeting invitation.…

Funds from the Humanity Protocol and KelpDAO exploits have commingled onchain, creating new evidence that may point to overlap between the attackers behind the two incidents. Onchain investigator ZachXBT flagged the fund commingling and linked it to a Bitcoin transaction that joined value connected to both exploit paths. The movement does not by itself prove that the same attacker carried out both breaches, but it creates a stronger shared-infrastructure signal than the earlier Humanity Protocol evidence alone. The new link…

Wallets tied to the UXLINK exploit have transferred 3,700 ETH into Tornado Cash, moving another large portion of the stolen funds beyond the attacker’s publicly visible wallet cluster. The latest onchain movement marks a shift from asset management into direct obfuscation. The deposits do not erase the transaction history, but they break the simple link between the exploit wallets and the addresses that eventually receive the funds, narrowing the options available to exchanges, investigators and the project. The Ethereum was…

Two Attacks Changed The 2026 Hack Table North Korea-linked hackers have accounted for 76% of all crypto hack losses in 2026 through April, according to new research from TRM Labs. The figure is not the result of dozens of smaller attacks. It comes from two huge incidents that overwhelmed the rest of the year’s exploit data. TRM placed the combined stolen value at about $577 million, split between the Drift Protocol exploit on April 1 and the KelpDAO bridge exploit…