Ripple this week shared threat intelligence tied to North Korean hacking groups, the company disclosed today, as the crypto industry grapples with an uptick in state-sponsored attacks. The data, provided to select partners and law enforcement, includes indicators of compromise and attack patterns linked to Pyongyang's cyber operations. It's a rare public acknowledgment of the scale of state-backed threats targeting digital asset firms.
What Ripple shared
The intelligence covers recent tactics and wallet addresses associated with North Korean actors, according to sources familiar with the matter. Ripple didn't name specific groups but said the information is drawn from its own security monitoring and industry collaboration. The company urged other firms to adopt similar threat-sharing practices. “We're seeing a coordinated effort by state-level adversaries,” the firm said in a statement, “and no single company can defend against that alone.”
Crypto hacks are evolving, and state sponsorship changes the math. Earlier this year, several exchanges reported breaches that security firms later linked to North Korean operatives. The attacks used social engineering, fake job offers, and zero-day exploits — methods that require resources most criminal groups don't have. Ripple's move signals that even large players feel the heat. The timing isn't great for an industry already under regulatory scrutiny.
North Korean hacking groups have stolen billions in crypto over the past few years, using the funds to evade sanctions and finance weapons programs. U.S. and South Korean authorities have stepped up warnings, but the pace of attacks hasn't slowed. Ripple's data dump is a practical response: share what you know before someone else gets hit. It's also a bet that transparency can force the ecosystem to harden faster.
Ripple said it will continue to release threat data periodically and called on other crypto firms to join a shared intelligence network. No timeline was given for the next disclosure, but the company expects to update its partners within weeks.
