2025-08
On August 14, 2025, BTCTurk suffered a major security breach with approximately $51.7 million drained from its hot wallets across seven blockchains—including ETH, AVAX, ARB, Base, OP, MANTLE and MATIC—following a private key leak.
🇹🇷 Türkiye
#Cryptocurrency
#FinancialGain
2025-08
S2W TALON attributed a South Korea-focused postal-code update lure campaign to ChinopuNK, a ScarCruft subgroup, with malicious LNK files in RAR archives dropping an AutoIt loader and retrieving follow-on payloads from external infrastructure. The payload …
Unknown
#FinancialGain
2025-07
On July 24, 2025, WOO X suffered a cryptocurrency-theft incident attributed by the exchange to suspected North Korea-linked activity. A developer ran a malicious open-source collaboration project on a company MacBook, giving the actor access through a com…
🇺🇸 United States
#Cryptocurrency
#FinancialGain
2025-07
In July 2025, Indian cryptocurrency exchange CoinDCX suffered a compromise of an internal operational account used for liquidity provisioning on a partner exchange. Linked reporting put exposure at about $44 million to $44.3 million, while CoinDCX said cu…
🇮🇳 India
#Cryptocurrency
#FinancialGain
2025-07
On July 16, 2025, cryptocurrency exchange BigONE suffered a third-party attack on its hot wallet, resulting in an estimated loss of about $27 million across multiple assets including BTC, ETH, USDT, SOL, DOGE, and SHIB. The attack path was quickly identif…
🇸🇨 Seychelles
#Cryptocurrency
#FinancialGain
2025-06
On June 25, 2025, Favrr’s FAVRR token DEX listing was exploited, with blockchain analysis estimating more than $680,000 stolen from the Web3 project. The analysis linked the loss to payroll and wallet flows involving suspected DPRK IT workers hired as dev…
🇬🇮 Gibraltar
#Cryptocurrency
#FinancialGain
2025-06
On June 18 and June 23, 2025, Matt Furie and ChainSaw-linked NFT projects including Replicandy, Peplicator, Hedz, and Zogz were exploited after contract ownership was transferred to attacker-controlled wallet 0x9Fca. The attacker unpaused mints, minted NF…
🇦🇺 Australia
#Cryptocurrency
#FinancialGain
2025-05
On May 9, 2025, Taiwan-based BitoPro suffered a cryptocurrency theft that forensic findings later said resembled Lazarus Group tradecraft. Attackers socially engineered a cloud operations employee, implanted malware, hijacked AWS session tokens to bypass …
🇹🇼 Taiwan
#Cryptocurrency
#FinancialGain
2025-05
On May 9, 2025, LNDfi suffered a \$1.27 million security breach caused by a rogue developer—later identified as an undercover North Korean IT worker—who gained unauthorized access to admin keys and drained the protocol. The attacker deployed altered smart…
Unknown
#Cryptocurrency
#FinancialGain
2025-05
In late April 2025, a North Korean hacking group known as Kimsuky compromised CJ OliveNetworks' digital certificate, which is used to verify the authenticity of software. The stolen certificate was found embedded in malware, suggesting it was used to disg…
🇰🇷 Korea, Republic of
#SupplyChain
#Technology
2025-03
On March 21, 2025, Zoth suffered a major security breach resulting in the loss of approximately $8.4 million worth of USD0++ tokens. This incident occurred just three weeks after a smaller attack on March 1, which had already exposed vulnerabilities in th…
🇵🇦 Panama
#Cryptocurrency
#FinancialGain
2025-02
On February 21, 2025, ByBit suffered the largest crypto hack in history, losing $1.43 billion. Attackers used a sophisticated front-end spoofing attack to deceive multisig signers into approving malicious transactions. The theft involved over 401,000 ETH …
🇦🇪 United Arab Emirates
#Cryptocurrency
#FinancialGain
2025-02
Safe{Wallet} and external analyses described the Bybit incident as a targeted Lazarus/TraderTraitor attack in which a compromised Safe{Wallet} developer environment enabled malicious front-end code to alter a multisig transaction proposal. The injected Ja…
🇨🇭 Switzerland
#Cryptocurrency
#SupplyChain
#FinancialGain
2025-02
A state-sponsored hacking group has stolen a code-signing certificate from a Korean cybersecurity firm, potentially allowing them to distribute malware disguised as legitimate software. The Korea Internet & Security Agency (KISA) is investigating and work…
🇰🇷 Korea, Republic of
#SupplyChain
#Technology
2025-01
On January 23, 2025, Phemex suffered a $73 million hack, with funds drained from hot wallets across 16 chains, including Ethereum, Solana, and XRP. The attack exploited access control vulnerabilities, enabling rapid and synchronized thefts. While cold wal…
🇸🇬 Singapore
#Cryptocurrency
#FinancialGain