22-Month Infiltration Exposes North Korean Crypto Hack Campaign Targeting Coinbase and Uniswap

Woofun AI reports that a Greek security researcher has exposed a prolonged cyber campaign orchestrated by a North Korean hacking group, with major cryptocurrency platforms Coinbase and Uniswap Labs identified as primary targets. This revelation stems from an extensive infiltration of the adversary’s infrastructure, shedding light on the strategic focus of state-sponsored attacks within the digital asset sector.

The operation spanned approximately 22 months, during which the researcher maintained persistent access to the hacking group’s servers. This sustained intrusion uncovered a massive campaign directed at 1,640 organizations worldwide. The sheer scale of the targeting list indicates a systematic effort to map and exploit vulnerabilities across the global financial and technological landscape.

Woofun AI data shows that between 700 and 800 of these targeted entities were successfully compromised, granting attackers critical technical access. The intruders secured root privileges on servers and gained control over AWS root accounts, but most significantly, they extracted cryptocurrency wallet keys. This level of access represents a severe breach of security perimeters, allowing for direct manipulation of digital assets.

Notably, the attackers demonstrated a clear financial motive by prioritizing cryptocurrency-related assets over other sensitive information. Despite having access to medical records and criminal databases, the group largely ignored this data. Instead, their operations focused exclusively on cryptocurrency wallets and blockchain access rights, suggesting that the primary objective was monetary gain rather than intelligence gathering or espionage.

The researcher issued warning messages to Coinbase and Uniswap Labs, both of which were among the targeted entities. While these companies responded to the alerts, the specific details of their remediation efforts remain undisclosed. This incident highlights the persistent threat North Korean hacking groups pose to the cryptocurrency industry, which remains attractive due to the potential for anonymous and cross-border transactions.

This exposure underscores the necessity for robust security measures, including regular audits and multi-layered defenses, to protect critical assets. With over 1,600 organizations affected, the findings emphasize the ongoing risk posed by North Korean hacking groups. The industry must remain vigilant against such sophisticated, financially driven cyber threats.