Latest North Korea news

One North Korea-linked threat cluster now publishes malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist in parallel, reusing the same staging infrastructure and loader patterns. Socket has tracked more than 1,700 packages tied to the broader Contagious Interview …

A fake token worth a few thousand dollars turned into a $285 million drain on Drift Protocol in 12 minutes. Attackers hijacked governance through durable nonces and social engineering. TRM Labs and Elliptic point to North Korea.

Blockchain forensics analysts traced the $625 million Ronin bridge hack to North Korea's Lazarus Group. A breakdown of timing correlation, address clustering, and the exchange records that connected 12,000 addresses to Pyongyang.

Open a project folder in VS Code, click "Trust," and North Korean malware executes instantly. Sophos documents how NICKEL ALLEY weaponised tasks.json to target crypto and Web3 developers through fake job interviews. The technique has been active since December 2025.