ChainCatcher news, according to The Block, the South Korean government has imposed sanctions on 15 North Korean individuals and one entity for their involvement in illegal cyber activities, including cryptocurrency theft. According to Chainalysis data, North Korean hackers stole $1.34 billion worth of cryptocurrency in 2024, accounting for 61% of the total stolen that year.The sanctioned individuals are all members of the 313 Bureau under the Ministry of Machine Industry of the Workers' Party of Korea, which has been under United Nations Security Council sanctions since 2016 and is responsible for North Korea's weapons production, including ballistic missile programs. The South Korean Ministry of Foreign Affairs stated that North Korean IT personnel often disguise their identities and travel to countries such as China, Russia, Southeast Asia, and Africa to obtain work orders from global IT companies while also engaging in information theft and cyberattacks.

ChainCatcher message, ZachXBT disclosed on platform X that a hacker has stolen approximately $500,000 over the past month by compromising more than 15 X accounts (Kick, Cursor, Alex Blania, The Arena, Brett, etc.). These accounts were targeted through phishing emails impersonating the X team to steal credentials, followed by initiating Meme coin scams. The attacker has been bridging transfers back and forth between Solana and Ethereum in an attempt to obfuscate the source of the funds.All email attacks seem to follow the same script:Send fake copyright infringement emails;Create a sense of urgency;Lure users to visit phishing sites and reset 2FA/password.

ChainCatcher message, according to CertiK Alert monitoring, the Moonhacker contract has suffered a flash loan attack, with current losses of approximately $320,000. The vulnerability is located in the Moonwell lending pool on Optimism. The attacker input the contract address as "mToken" to gain additional token authorization from Moonhackers and deplete it.

ChainCatcher news, according to CoinDesk Japan, regarding the theft of 4,502.9 BTC from the cryptocurrency exchange DMM Bitcoin that occurred in May, the National Police Agency of Japan reported on December 24 that the incident was carried out by the Trader Traitor group, which is part of the North Korean hacker organization Lazarus Group.The National Police Agency of Japan stated that it will continue to work with the FBI, other U.S. government agencies, and international partners to investigate the illegal activities of North Korean hackers, including cybercrime and cryptocurrency theft incidents.Meanwhile, the National Police Agency of Japan, the Cabinet Cybersecurity Center, and the Financial Services Agency have released documents regarding the tactics and countermeasures of the attacking groups, urging cryptocurrency-related businesses to exercise caution. In response to this attack, DMM Bitcoin has decided to close its exchange. Assets and customer accounts will be transferred to SBIVC Trade, with the transition expected to be completed by March 2025.

ChainCatcher news, according to the official announcement, Hyperliquid Labs has stated that it is aware of reports regarding the activities of so-called North Korean hacker addresses. In fact, Hyperliquid has not suffered any attacks from North Korean hackers—nor has any form of attack occurred. All user funds are being managed properly.Hyperliquid Labs takes operational security very seriously. No party has disclosed any vulnerabilities. As always, Hyperliquid Labs offers a generous reward program for vulnerability reports and adheres to industry best standards for blockchain analysis.Previously, someone claimed to be from the security side and attempted to contact Hyperliquid Labs. To clarify, Hyperliquid Labs has never received any allegations regarding attacks on its platform. This party added a fraudulent account to the group chat and subsequently communicated with us using insults and profanity. Given the level of professionalism displayed, Hyperliquid Labs confirmed with trusted parties to ensure that it is following best practices.

ChainCatcher news, according to CoinDesk, the perpetual contract trading platform HyperLiquid experienced a record net outflow of 60 million USDC on December 23.Previous news, according to hacker behavior observer Tay, addresses suspected to be linked to North Korean hackers have incurred losses exceeding 700,000 dollars on the platform, possibly testing the platform's vulnerabilities.

ChainCatcher news, according to DL News, Cozy Finance's latest research shows that less than 50% of DeFi projects that have been hacked survive. Cozy surveyed 64 projects that had at least $1 million in user deposits at the time of the hack, and found that 39% of the projects (i.e., 25 projects) successfully survived.The report points out that many DeFi founders are pessimistic about hacking attacks. Although they strive to implement the best security measures to prevent attacks, they often believe that once hacked, the project may come to an end. However, the research indicates that the likelihood of project survival is greater than expected.

ChainCatcher news, overseas KOL Tay整理数据显示 that multiple North Korean hacker addresses that have been flagged are recently trading on Hyperliquid, with total losses exceeding $700,000.Several community members are concerned that these trading activities may indicate that North Korean hackers have targeted Hyperliquid as a potential target and are testing the system's stability by executing trades.

ChainCatcher news, according to a report by Techcrunch, the Chainalysis report released on Thursday shows that the total value of stolen cryptocurrency has surged by 21% this year, reaching $2.2 billion, with over half of the amount stolen by hacker groups linked to North Korea. In 2024, North Korean-linked hackers stole 61% of the total amount stolen that year in 47 cases, worth $1.34 billion; in 2023, they stole $660.5 million in 20 cases, and in 2022, they stole $400 million. This indicates that they are increasingly involved in these attacks.The report emphasizes that most cryptocurrency hacking incidents this year occurred from January to July, with the amount stolen exceeding $1.58 billion, approximately 84.4% higher than the same period in 2023. After July, the upward trend significantly slowed down, which is markedly different from 2021 and 2022, possibly due to geopolitical issues. Chainalysis attributes the stagnation in the number of hacks after July to the alliance between North Korea and Russia, which emerged after the meeting between Russian President Putin and North Korean leader Kim Jong-un in June. Since the June summit, the amount of cryptocurrency assets stolen by North Korea has decreased by 53.73%. As cooperation between North Korea and Russia strengthens, North Korea may change its cybercrime tactics.

ChainCatcher news, according to CoinDesk, the hacker involved in the Bitfinex theft case has made a public statement for the first time since being arrested. Ilya Lichtenstein reiterated that he alone stole 120,000 bitcoins, denying the speculation in the Netflix documentary that "his father was complicit and may belong to a Russian spy agency." This is his first public statement since his arrest in 2022.In the video statement, Lichtenstein said, "My father is not a hacker; he doesn't even know how to use Instagram. I sincerely apologize to Bitfinex for all the pressure I have caused them. I know what I did was wrong, but I did it anyway. Looking back at who I was then, I hate myself. I hate myself. For the past three years, I have been working hard to trace all assets and return them down to the last satoshi as required by my plea agreement, and I will continue to do so."

Message: The security product MistTrack under the Slowmist team has released the latest progress on the DEXX hacker incident: As of now, the hacker has laundered 6432.4 ETH through Tornado Cash. The main EVM address 0xFFB9...8228 has a balance of $19,446, distributed across Ethereum, BSC, and BASE chains; the Solana address 4smi8...HLd has a balance of $59,540, and GPuNX...RKgt has a balance of $2,200.Since November 16, the total amount of funds reported stolen by the community is approximately $23 million (affected by price fluctuations).MistTrack stated that it has assisted in the investigation for a month, and the incident is nearing its conclusion. Future updates will be reduced, and for more information, please pay attention to the official announcements from DEXX.

ChainCatcher message, SolTradingBot issued a statement regarding the rumors of an attack event, stating: "All malicious rumors are false. We have received allegations that STBOT is invading user wallets and draining their SOL. However, after a thorough investigation, we confirm that this is entirely a fabricated post aimed at damaging our reputation. The investigation results show that the so-called 'hacker wallet' is actually controlled by users holding the private keys. We are still investigating the motives behind these funds, but it is likely related to malicious actions intended to discredit and harm us. SolTradingBot remains firmly supportive of our users. We are always ready to address and clarify any issues. Please be vigilant against wrongdoers and their harmful intentions."

ChainCatcher message, the Chill Guy character artist Phillip Banks's account is still in a struggle for control with hackers, and has just released a contract for a new Meme coin, which was deleted shortly after the tweet was posted.

ChainCatcher news, according to Protos, the X account of the crypto podcast UpOnly was hacked on December 10, with the hackers attempting to promote a fake token.UpOnly host Brian Krogsgard (Ledger) stated that he was not in control when the hackers took over the account, and this security breach was not a SIM swap incident. The hackers deleted the posts about the fake token, leaving only content bragging about earning a six-figure income through host Cobie's image.

ChainCatcher message, SlowMist's Web3 security tool MistTrack has released an update on the DEXX security incident:The DEXX hacker has transferred 1,512.4 ETH to Tornado Cash;A total of 3,149.55 ETH remains in some Ethereum addresses;The main EVM aggregation address (starting with 0xFFB9) currently has a balance of 1,253.83 ETH and other tokens worth $130,000;The Solana address (starting with 4smi8T) has a balance of $96,417, and the Solana address (starting with GPuNX8) has a balance of $2,200.The team will continue to monitor the funds situation.

ChainCatcher message, Slow Mist's Yuxian posted on X: "This morning, the DEXX hacker transferred another 300 ETH into the Tornado Cash mixing protocol."

ChainCatcher news, according to a report by Cointelegraph, Radiant Capital stated in an updated investigation report on December 6 that the cybersecurity company Mandiant has assessed with high confidence that the attack was carried out by threat actors affiliated with North Korea (DPRK).The platform mentioned that a Radiant developer received a Telegram message on September 11, which contained a compressed file from a "trusted former contractor," requesting feedback on a new project they were planning. Upon review, this message was suspected to be from threat actors allied with North Korea impersonating the former contractor. "This ZIP file, when shared with other developers for feedback, ultimately delivered malware that facilitated the subsequent intrusion."Radiant Capital believes that the threat actors responsible for the incident are referred to as "UNC4736"—reportedly associated with North Korea's main intelligence agency, the Reconnaissance General Bureau (RGB), and speculated to be a subgroup of the hacking organization Lazarus Group.Previous report stated that the cross-chain lending protocol Radiant Capital suffered a cyber attack, resulting in losses exceeding $50 million.

ChainCatcher news, according to Decrypt, the founder of blockchain security company Immunefi, Mitchell Amador, stated in an interview that despite the threat of "professional DeFi attackers," the cryptocurrency space is undoubtedly becoming increasingly secure, and at a very fast pace.He pointed out the results of Immunefi's Q3 2024 report, which found that losses caused by cryptocurrency hackers decreased by 38% year-on-year, falling to just below $424 million.Amador added that hacking attacks on DeFi protocols have become a "full-time job" for professional attackers, and DeFi hacking has become "an infinitely sustainable and viable industry."

ChainCatcher news, Radiant Capital's official report on the October theft has been released today.Radiant Capital stated that although the investigation is still ongoing, the security company Mandiant is highly confident that the attack was carried out by malicious actors linked to North Korea.ChainCatcher previously reported that according to information disclosed by the security company Ancilia, the cross-chain lending protocol Radiant Capital suffered a cyber attack on the early morning of October 17, resulting in losses exceeding $50 million. Radiant is controlled by a multi-signature wallet (referred to as "multisig"), and it is claimed that the attackers gained control of the private keys of multiple signers, subsequently taking control of several smart contracts.