DPRK hackers steal $137M from TRON users in single-day phishing attack

Multiple threat activity clusters with ties to North Korea (aka Democratic People’s Republic of Korea or DPRK) have been linked to attacks targeting organizations and individuals in the Web3 and cryptocurrency space.

“The focus on Web3 and cryptocurrency appears to be primarily financially motivated due to the heavy sanctions that have been placed on North Korea,” Google-owned Mandiant said in its M-Trends report for 2025 shared with The Hacker News.

“These activities aim to generate financial gains, reportedly funding North Korea’s weapons of mass destruction (WMD) program and other strategic assets.”

Read more at The Hacker News