Ripple has begun contributing exclusive threat intelligence on North Korean cyber actors to the Crypto Information Sharing and Analysis Center, known as Crypto ISAC, as the industry responds to a shift in how major crypto breaches occur.
The shared dataset focuses on Democratic People’s Republic of Korea-linked operations targeting digital asset firms. It includes domains, wallets, and indicators of compromise tied to active campaigns, along with enriched profiles of suspected North Korean IT workers attempting to enter crypto companies through legitimate hiring channels.
The move reflects growing concern that attackers no longer rely primarily on smart contract vulnerabilities. Instead, they increasingly operate inside organizations over extended periods.
The strongest security posture in crypto is a shared one.
— Ripple (@Ripple) May 4, 2026
A threat actor who fails a background check at one company will apply to three more that same week. Without shared intelligence, every company starts from zero.
Ripple is now contributing exclusive DPRK threat… https://t.co/ZiXD25iOBx
Drift hack exposed long-term infiltration tactics
The industry response follows incidents such as the Drift breach, which Crypto ISAC described as a turning point in threat awareness.
The attack did not begin with a technical exploit. It developed through months of social engineering against contributors before malicious software compromised devices. That access allowed attackers to bypass traditional indicators of compromise and take control of multisig wallets.
“Crypto ISAC characterized the campaign as social engineering at a new level,” according to the organization’s description of the incident.
Crypto ISAC Executive Director Justine Bone said,
“For too long, information sharing was seen as optional. Today, it is the gold standard for security.”
The Drift case highlighted how attackers now target trust relationships rather than only software systems. That shift has placed pressure on security teams to identify individuals who may already appear credible inside organizations.
Ripple expands intelligence sharing to industry partners
Ripple said it now contributes internally generated threat intelligence to Crypto ISAC members. The data comes from detection systems focused on crypto-specific threat patterns and DPRK-linked activity.
According to Ripple, the shared material includes:
- Wallet addresses linked to fraudulent activity
- Domains tied to active campaigns
- Indicators of compromise from ongoing operations
- Enriched identity profiles of suspected DPRK-linked individuals
The profiles extend beyond standard technical indicators. They may include LinkedIn accounts, email addresses, phone numbers, and location data connected to coordinated activity.
Ripple brand security director Erin Plante said,
“Crypto ISAC’s newly updated API represents a meaningful step forward in how intelligence is shared across the ecosystem,” adding that it allows firms to integrate “higher-quality, more actionable intelligence” into their workflows.
The Crypto ISAC system normalizes data across Web2 and Web3 environments, enabling member companies to respond more quickly to shared threat signals.
Industry collaboration targets repeated infiltration attempts
Crypto ISAC and its members describe a recurring pattern in DPRK-linked activity. A threat actor rejected by one company may reapply elsewhere within days. Without shared intelligence, each organization evaluates the same candidate or contractor in isolation.
Jeff Lunglhofer, Chief Information Security Officer at Coinbase, said the updated system helps improve decision-making. He noted that the model preserves “context and confidence while improving real-time response.”
The system aims to reduce fragmentation in threat detection. Instead of isolated alerts, firms receive structured intelligence that links identity, behavior patterns, and technical indicators.
Crypto ISAC stated that the approach only works if members actively integrate and act on shared data. The organization positioned collaboration as essential rather than optional.
Shift from code exploits to human compromise
Earlier waves of crypto attacks between 2022 and 2024 primarily focused on smart contract vulnerabilities. Security teams tracked protocol-level flaws and exploited code paths in decentralized finance systems.
Recent incidents show a different pattern. Attackers now rely on long-term social engineering campaigns that embed operatives inside companies.
The Drift case illustrates that transition. Attackers established trust before deploying malware. Once inside systems, they accessed sensitive wallet infrastructure without triggering conventional alerts.
This shift has forced firms to reassess hiring, onboarding, and contractor verification processes. It also expanded the role of threat intelligence beyond technical monitoring into personnel-level risk analysis.
Crypto ISAC described the evolution as a structural change in how attacks unfold across the industry.
Legal and enforcement pressure increases alongside cyber activity
Security concerns have begun intersecting with legal disputes involving frozen assets tied to North Korea-linked exploits.
In parallel developments referenced by industry filings, attorneys representing victims of DPRK-related incidents have sought enforcement actions over funds connected to bridge exploits. Exchanges and DeFi protocols have challenged aspects of those claims, arguing over ownership and recovery rights for stolen assets.
These disputes reflect broader uncertainty about how stolen digital assets should be classified and recovered when linked to state-backed threat groups.
Combined losses attributed to DPRK-linked activity in recent incidents have exceeded hundreds of millions of dollars, according to public attribution cited in industry security reports.
Shared intelligence model faces adoption test
Crypto ISAC’s framework depends on rapid adoption across exchanges, protocols, and infrastructure providers. Ripple and Coinbase are among the early participants integrating the API into operational security systems.
The model aims to reduce repeated exposure to known threat actors by distributing enriched intelligence across member organizations in real time.
Whether this approach limits future infiltration attempts remains dependent on participation scale and speed of response. The same actor patterns identified in past incidents suggest continued pressure on onboarding pipelines and internal access controls.
For Ripple, the contribution represents a shift toward collective defense. For Crypto ISAC, it reflects a push to turn fragmented signals into coordinated action across the digital asset ecosystem.
Tanya Petrusenko
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
