# DPRK (North Korea) · Drain Watch

9 incidents, 3 live. JSON: https://drains.watch/t/dprk.json · RSS: https://drains.watch/t/dprk/feed.xml

- [Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances](https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026) (live, Critical, Contained, since Sep 24, 2026)
- [Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets](https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026) (live, Critical, Still active, since Sep 18, 2026)
- [Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions](https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026) (live, Critical, Contained, since Apr 1, 2026)
- [Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent](https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026) (closed, Medium, Still active, since Feb 28, 2026)
- [North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech](https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026) (closed, Medium, Still active, since Feb 9, 2026)
- [North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor](https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026) (closed, Medium, Still active, since Jan 22, 2026)
- [Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks](https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025) (closed, Medium, Still active, since Oct 28, 2025)
- [THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend](https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025) (closed, Critical, Still active, since Sep 4, 2025)
- [North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac](https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025) (closed, Medium, Still active, since Jun 11, 2025)