Inside the Crypto-Funded Operations of North Korean Hackers

[mendez]

Leaked data from the operation revealed surprisingly basic security practices, including the use of weak shared passwords like “123456” on internal platforms. Despite this, the group successfully coordinated crypto payments and tracked performance through internal leaderboards, showing how much each member contributed to the operation.

Investigators also found links between these wallets and addresses previously blacklisted by Tether, indicating connections to sanctioned entities. The funds were ultimately converted and moved through international payment rails, demonstrating how illicit crypto flows can still interface with traditional financial systems when not quickly detected.

[AIcash]

running a multi-million dollar operation with “123456” as a password is wild

[kevin1]

high-level operation on paper, middle school security practices in reality