North Korea
Security incidents tagged North Korea. Newest first.
0 North Korea incidents in the last 12 months
- Incidents
- 4
- Live
- 0
- Patched
- 4
- Days without an incident
- 609
- Longest quiet run: 596 days (Mar 7–Oct 23)
Show 4 older incidents4 older incidents
February 2025 1
- CriticalNo fix needed
Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)
North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.
Bybit cold wallet / Safe{Wallet} web UIClosed Mar 6, 2025
September 2023 1
PatchedTeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)
JetBrains TeamCity On-Premises
An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.
Open incident →CVE-2023-42793
June 2023 1
HighJumpCloud breached by North Korean hackers to reach crypto customersNo fix needed
JumpCloud (directory / device management SaaS) No fix needed
A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.
March 2023 1
- Patched
3CX DesktopApp supply-chain attack (trojanized signed builds)
Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.
3CX DesktopApp (Electron)Closed Apr 20, 2023
