{
 "tag": "north-korea",
 "name": "North Korea",
 "group": "Other",
 "incidents": [
  {
   "slug": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "title": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "json": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The malicious dependency entered an AI trading agent through a commit co-authored by Claude Opus, and ReversingLabs assesses the attackers wrote promotional package pages to lure AI coding agents."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "AI trading agent projects and Web3 developers on npm",
   "tags": [
    "solana",
    "supply-chain",
    "npm",
    "pypi",
    "ai-coding-agent",
    "claude",
    "ai-trading-bot",
    "famous-chollima",
    "north-korea",
    "dprk",
    "promptmink",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-28",
   "closedAt": "2026-04-29",
   "updatedAt": "2026-04-29T12:00:00Z",
   "summary": "ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines."
  },
  {
   "slug": "upbit-solana-hot-wallet-hack-nov-2025",
   "title": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025",
   "json": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": null,
   "product": "Upbit exchange Solana hot wallet",
   "tags": [
    "solana",
    "exchange",
    "cex",
    "hot-wallet",
    "upbit",
    "lazarus",
    "north-korea"
   ],
   "amountUsd": 36000000,
   "victims": null,
   "startedAt": "2025-11-27",
   "closedAt": "2025-11-27",
   "updatedAt": "2025-11-28T12:00:00Z",
   "summary": "On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing."
  }
 ],
 "changes": [
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-29",
   "title": "ReversingLabs published its findings and linked the campaign to Famous Chollima.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-28",
   "title": "A commit co-authored by Claude Opus added @solana-launchpad/sdk to the openpaw-graveyard trading agent, pulling in the malicious @validate-sdk/v2.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-28",
   "title": "Yonhap reported that South Korean authorities suspect the Lazarus Group and are preparing an on-site probe; CertiK said it tracked over 100 exploiter addresses.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-27",
   "title": "Upbit disclosed irregular withdrawals that drained about $36M in multiple Solana tokens from a hot wallet, froze the wallets and moved remaining funds to cold storage.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  }
 ]
}