2025 Fireblocks — published threat intelligence on DPRK-aligned cryptocurrency theft tradecraft affecting custodial stacks
Data compromised
Digital asset balances and signing keys where organizations were successfully phished or compromised.
Technical writeup
Fireblocks published technical narrative linking financially motivated wallet/custody intrusions to North Korean activity patterns and customer mitigation guidance; trade press summarized targeted firms using shared infrastructure.
Root cause
Credential theft / wallet takeover tactics aligned with known APT campaigns (per vendor intelligence article).