North Korean Crypto Heists Begin with Staging Domains, Silent Push Says
Summary
Silent Push says North Korean operations targeting crypto firms rely on staging domains and developer lures. It links bybit-assessment[.]com to an operator persona and reports 206 Binance-named domains scored 100, with at least 64 live in a recent scan.
Key points
- Sygnia’s cited investigation says the 2025 Bybit theft began after a Safe{Wallet} engineer ran a fake stock-trading project that contacted getstockprice[.]com.
- Silent Push says bybit-assessment[.]com was registered hours before the theft and linked to a known North Korean operator persona.
- The article says Binance has pointed to a compromised DevOps engineer’s laptop, citing BleepingComputer.
- Silent Push reports that its IOFA feeds list 206 Binance-named domains at its maximum risk score of 100; at least 64 returned live pages in web-scan data that week.
- Silent Push says its April 2025 investigation identified BlockNovas, Angeloper Agency, and SoftGlide as front companies used to push malware to crypto developers through fake job interviews; the FBI seized the BlockNovas domain that same week.
Article Details
- Event Type
- North Korean-linked cyber operations targeting cryptocurrency firms and developers, including thefts and malware staging.
- Impact
- The article describes the February 2025 Bybit theft, in which operators reportedly tricked a Safe{Wallet} engineer into running a fake stock-trading project and later planted code in the wallet interface used by Bybit signers. It also reports that Binance points to a compromised DevOps engineer’s laptop in connection with a crypto theft. The operations used malicious domains and fake job interviews to establish footholds or deliver malware to cryptocurrency developers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bybit-assessment[.]com | Domain tied by Silent Push to a known North Korean operator persona and registered hours before the Bybit theft. |
| DOMAIN | getstockprice[.]com | Domain contacted by a fake stock-trading project that North Korean operators reportedly used to trick a Safe{Wallet} engineer. |
Threat Actors
Products
BinanceBinance now points to a compromised DevOps engineer’s laptop (BleepingComputer), and North Korean operators have targeted engineers in exactly that role for years.BybitThe Bybit theft in February 2025 began with one developer.Safe{Wallet}North Korean operators tricked a Safe{Wallet} engineer into running a fake stock-trading project that called out to getstockprice[.]com (Sygnia).