Ripple joins Crypto ISAC to share North Korean threat intelligence with the broader crypto industry

[lingriiddd]

Ripple has begun contributing exclusive threat intelligence on North Korean cyber actors to Crypto ISAC, a nonprofit organization that enables crypto companies to share security information and coordinate defenses against digital asset threats. The intelligence feed covers fraudulent domains, wallet addresses, and indicators of compromise from active DPRK hack campaigns, along with enriched profiles of suspected North Korean IT workers attempting to embed themselves inside crypto firms. Each profile includes a LinkedIn account, email address, location, and contact number alongside signals connecting that individual to a broader state-sponsored campaign. Ripple, Coinbase, and other founding members are integrating the data through Crypto ISAC's new API, which normalizes indicators across both Web2 and Web3 environments and feeds directly into member security operations centers.

The initiative reflects a structural shift in how the crypto industry is approaching the North Korean threat, which has evolved from opportunistic smart contract exploitation to long-duration infiltration operations that take months to execute and are nearly impossible to detect through traditional security tooling. Crypto ISAC executive director Justine Bone framed the shift directly: information sharing was previously treated as optional in the industry, and the organization is now positioning it as the gold standard for security. The practical case for collective defense is specific: a threat actor who fails one company's background check typically applies to multiple other firms in the same week, and without shared intelligence every organization facing Lazarus Group tactics starts from zero rather than building on what others have already learned. Coinbase CISO Jeff Lunglhofer noted that the data model is designed to preserve context and confidence levels alongside raw indicators, making the intelligence actionable rather than just voluminous.

[cryptohog]

North Korea applying to every crypto company in the same week after failing one background check is extremely relatable job hunting behavior

[nihalsari]

hmmm lets see how it will work out