Ripple Opens Threat Intelligence on North Korea-Linked Crypto Attacks

Crypto ISAC, a nonprofit focused on crypto security, announced Tuesday that Ripple is contributing fraud-associated domains, wallet addresses, and indicators of compromise tied to North Korean hacking activity. The data will be made available to industry participants through a newly launched API designed for fast, actionable intelligence sharing. Ripple, Coinbase, and other founding members of Crypto ISAC are among the first to integrate the tool into their security operations.

The initiative follows the $280 million Drift incident, which Crypto ISAC described as a "wakeup call for the industry." The attack did not originate from a smart contract exploit or a code vulnerability. Instead, threat actors spent six months gaining the trust of Drift contributors before compromising their devices.

Crypto attacks attributed to North Korean groups have grown sharply as a of global crypto hack losses. According to blockchain intelligence firm TRM Labs, North Korea's portion of global crypto hack losses climbed from below 10% in 2020 and 2021 to 64% in 2025. TRM Labs has also linked the $292 million Kelp DAO exploit to TraderTraitor, a Lazarus-affiliated operation.

North Korean authorities have denied involvement in crypto theft. A Foreign Ministry spokesperson called the allegations "absurd slander" and described them as a political tool, according to state news agency KCNA.

The $280 million Drift loss and the $292 million KelpDAO exploit together illustrate the scale of the threat. Crypto ISAC said the new API is intended to give member firms the ability to act on threats in real time rather than merely respond after incidents have already occurred.