{
 "tag": "dprk",
 "name": "DPRK (North Korea)",
 "group": "Other",
 "incidents": [
  {
   "slug": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "title": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026",
   "json": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "arbitrum",
    "avalanche",
    "optimism",
    "bsc",
    "base"
   ],
   "method": null,
   "product": "Bitget exchange hot and warm wallets",
   "tags": [
    "ethereum",
    "arbitrum",
    "avalanche",
    "optimism",
    "bsc",
    "base",
    "exchange",
    "bitget",
    "hot-wallet",
    "zero-day",
    "infrastructure-breach",
    "dprk"
   ],
   "amountUsd": 387500000,
   "victims": null,
   "startedAt": "2026-09-24",
   "closedAt": "2026-09-28",
   "updatedAt": "2026-10-15T12:00:00Z",
   "summary": "Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund."
  },
  {
   "slug": "waterplum-contagious-interview-advisory-sep-2026",
   "title": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026",
   "json": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The attackers reportedly use AI face-swapping software during online job interviews, then turn off their cameras and blame network problems."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto, AI and NFT developers and job seekers",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "waterplum",
    "contagious-interview",
    "fake-job-interview",
    "npm",
    "vscode",
    "beavertail",
    "invisibleferret",
    "ottercookie",
    "stoatwaffle",
    "infostealer",
    "ai"
   ],
   "amountUsd": 10710000,
   "victims": 7000,
   "startedAt": "2026-09-18",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "On 18 September 2026 Japanese, US, Australian and German authorities warned that the North Korean group WaterPlum, linked to the 'Contagious Interview' campaign, infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto or NFT firms and recruiters, they get targets to run code during fake interviews and coding tests, including malicious npm packages and VS Code projects, then steal private keys, seed phrases and passwords. Funds or credentials were taken from over 7,000 wallets, and more than 1.7 billion yen (about $10.71M) went to North Korea. The advisory does not say the campaign has stopped."
  },
  {
   "slug": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "title": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "json": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-attack",
    "note": "TRM Labs investigator Nick Carlsen, a former FBI analyst, assessed it highly likely that the attackers used AI to pick targets and design the exploit, as The Next Web reported citing Bloomberg; this is an expert assessment, not confirmed."
   },
   "chains": [
    "solana"
   ],
   "method": "durable-nonce",
   "product": "Drift Protocol (Security Council multisig)",
   "tags": [
    "solana",
    "durable-nonce",
    "drift",
    "multisig",
    "security-council",
    "social-engineering",
    "admin-takeover",
    "cctp",
    "wormhole",
    "admin-key",
    "dprk",
    "tornado-cash",
    "laundering",
    "ai"
   ],
   "amountUsd": 285000000,
   "victims": null,
   "startedAt": "2026-04-01",
   "closedAt": "2026-04-01",
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "On Apr 1, 2026, an attacker took admin control of the Solana perps exchange Drift and drained its vaults of at least $270 million; SlowMist lists $285 million. Weeks earlier, Security Council signers had been led into 'unauthorized or misrepresented' approvals. Because those transactions used durable nonces, they stayed valid until the attacker chose to submit them. The funds were bridged to Ethereum, including more than $230 million in USDC via Circle's CCTP. No code bug was needed. The lesson for teams is that any durable-nonce signing request is high risk."
  },
  {
   "slug": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "title": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "json": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The malicious dependency entered an AI trading agent through a commit co-authored by Claude Opus, and ReversingLabs assesses the attackers wrote promotional package pages to lure AI coding agents."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "AI trading agent projects and Web3 developers on npm",
   "tags": [
    "solana",
    "supply-chain",
    "npm",
    "pypi",
    "ai-coding-agent",
    "claude",
    "ai-trading-bot",
    "famous-chollima",
    "north-korea",
    "dprk",
    "promptmink",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-28",
   "closedAt": "2026-04-29",
   "updatedAt": "2026-04-29T12:00:00Z",
   "summary": "ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines."
  },
  {
   "slug": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "title": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "json": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The victim reported an apparent deepfake video of a crypto CEO on the call; Mandiant could not verify it forensically but notes UNC1069's known use of AI tools to edit images or video and of Gemini for tooling and research."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto and DeFi fintech staff on macOS",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "unc1069",
    "masan",
    "cryptocore",
    "deepfake",
    "zoom",
    "fake-meeting",
    "clickfix",
    "telegram",
    "calendly",
    "macos",
    "mandiant",
    "gemini",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2026-02-09",
   "closedAt": "2026-02-09",
   "updatedAt": "2026-02-09T12:00:00Z",
   "summary": "Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount."
  },
  {
   "slug": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "title": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "json": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Check Point Research describes the payload as an AI-generated PowerShell backdoor."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Blockchain and crypto developers and engineering teams (Asia-Pacific)",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "konni",
    "powershell",
    "backdoor",
    "ai-generated-code",
    "blockchain-developers",
    "phishing",
    "check-point",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-22",
   "closedAt": "2026-01-22",
   "updatedAt": "2026-01-22T12:00:00Z",
   "summary": "Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported."
  },
  {
   "slug": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "title": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "json": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Kaspersky says generative AI has let BlueNoroff speed up malware development and refine its attack techniques; it describes the fake calls as replaying videos of earlier victims, not deepfakes."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Web3 and crypto executives, founders and blockchain developers",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "lazarus",
    "ghostcall",
    "ghosthire",
    "snatchcrypto",
    "fake-meeting",
    "fake-job-interview",
    "telegram",
    "github",
    "macos",
    "kaspersky",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-10-28",
   "closedAt": "2025-10-28",
   "updatedAt": "2025-10-28T12:00:00Z",
   "summary": "Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given."
  },
  {
   "slug": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "title": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "json": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account."
   },
   "chains": [
    "ethereum"
   ],
   "method": "social-engineering",
   "product": "THORChain co-founder's personal wallet",
   "tags": [
    "ethereum",
    "social-engineering",
    "dprk",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "metamask",
    "zachxbt",
    "thorchain",
    "thorswap",
    "ai"
   ],
   "amountUsd": 1350000,
   "victims": 1,
   "startedAt": "2025-09-04",
   "closedAt": "2025-09-12",
   "updatedAt": "2025-09-12T12:00:00Z",
   "summary": "In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected."
  },
  {
   "slug": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "title": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "json": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Huntress says the Zoom meeting contained several deepfakes of known senior leaders of the victim's company, used to make the call look genuine before the fake 'extension' install."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto foundation staff on macOS",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "ta444",
    "lazarus",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "calendly",
    "macos",
    "cryptobot",
    "infostealer",
    "huntress",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2025-06-11",
   "closedAt": "2025-06-18",
   "updatedAt": "2025-06-18T12:00:00Z",
   "summary": "Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen."
  }
 ],
 "changes": [
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-21",
   "title": "Another 18,800 ETH (about $46M) went to Tornado Cash, a two-day total of 44,510 ETH (about $109M); about 56,569 ETH stayed in exploiter-labelled wallets per Arkham.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-20",
   "title": "The Drift exploiter sent about $61M in ETH to Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-15",
   "title": "Hacken's Q3 data showed about $387M covered by Bitget's user protection fund; Circle and Tether froze about $340,000 tied to the theft.",
   "sourceUrl": "https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-01",
   "title": "The confirmed loss was put at $387.5 million, up from the first estimate of $351.6 million.",
   "sourceUrl": "https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-28",
   "title": "Bitget resumed Bitcoin withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-25",
   "title": "A custom withdrawal tool drained hot and warm wallets over nearly three hours after midnight (UTC+8); Bitget suspended withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Per Mandiant, the attacker gained privileged access to two third-party security appliances, then reached the wallet job server and deployed malicious packages.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "waterplum-contagious-interview-advisory-sep-2026",
   "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-19",
   "title": "BleepingComputer reported the advisory's figures: 30,000+ infected devices, 7,000+ wallets hit and over 1.7 billion yen stolen.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026"
  },
  {
   "incident": "waterplum-contagious-interview-advisory-sep-2026",
   "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-18",
   "title": "Japan, the US, Australia and Germany issued a joint advisory on WaterPlum covering activity from December 2025 to July 2026.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-08-31",
   "title": "SlowMist's report traced the earliest malicious activity in Bitget's logs to 31 August.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-29",
   "title": "ReversingLabs published its findings and linked the campaign to Famous Chollima.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-03",
   "title": "SecurityWeek reported Elliptic's $286M estimate and a likely North Korean link; about $225M had been swapped to Ethereum.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "About a minute after a legitimate insurance-fund test withdrawal, the attacker submitted two pre-signed transactions, took admin control and drained the vaults.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Attackers executed pre-signed durable-nonce transactions to take Drift's admin key, created a fake CVT collateral market, raised the circuit breaker and drained six assets in about 10 seconds.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-30",
   "title": "A new durable nonce account tied to a member of the updated multisig appeared.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-27",
   "title": "Drift executed a planned Security Council migration to replace a member.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Four durable nonce accounts were created, two tied to Security Council members and two controlled by the attacker.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-28",
   "title": "A commit co-authored by Claude Opus added @solana-launchpad/sdk to the openpaw-graveyard trading agent, pulling in the malicious @validate-sdk/v2.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "incidentTitle": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-09",
   "title": "Mandiant published its analysis, naming seven malware families including WAVESHAPER, HYPERCALL and SUGARLOADER.",
   "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026"
  },
  {
   "incident": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "incidentTitle": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-22",
   "title": "Check Point Research published its findings on KONNI's AI-generated backdoor aimed at blockchain developers.",
   "sourceUrl": "https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026"
  },
  {
   "incident": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "incidentTitle": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-28",
   "title": "Kaspersky disclosed the GhostCall and GhostHire campaigns and their targets.",
   "sourceUrl": "https://www.kaspersky.co.uk/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.",
   "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-04",
   "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-18",
   "title": "Huntress published its analysis, attributing the attack to BlueNoroff (TA444).",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-11",
   "title": "Huntress was contacted about the intrusion on the employee's Mac.",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  }
 ]
}