Expel Links HexagonalRodent Campaign to Up to $12 Million in Crypto Theft
Summary
Expel investigators linked the HexagonalRodent campaign to North Korean actors and said it stole up to $12 million from 26,584 crypto wallets on 2,726 systems, using malware and fake job offers targeting Web3 developers.
Key points
- Expel investigators led by Marcus Hutchins linked HexagonalRodent to North Korean state-backed actors tracked as Famous Chollima.
- Hutchins said the campaign stole up to $12 million in cryptocurrency during the first three months of 2026 from 26,584 wallets on 2,726 infected systems.
- The campaign used BeaverTail, OtterCookie, and InvisibleFerret to steal credentials and cryptocurrency.
- Operators targeted Web3 developers with fake LinkedIn job offers and sham companies, then provided malware-laced coding assessment tools.
- Expel investigators accessed an internal panel used to collect BeaverTail metrics; the malware can exfiltrate credentials from password managers and the macOS Keychain.
- Internal documents described 31 hackers organized into six teams, with evidence that former members formed separate operations.
Article Details
- Event Type
- North Korea-linked cryptocurrency theft campaign using malware and fake job offers to target Web3 developers.
- Impact
- Expel reported that the campaign stole up to $12 million in cryptocurrency from 26,584 wallets across 2,726 infected systems. The malware also harvested credentials, including from password managers and the macOS Keychain.
MITRE ATT&CK
People
Threat Actors
Contagious InterviewA group named by Marcus Hutchins and associated by Expel with a campaign that used malware and fake job offers to steal cryptocurrency and credentials. The article reports evidence that members split off to form other operations.Void DokkaebiExpel linked the HexagonalRodent operation to North Korean state-backed actors tracked as Famous Chollima.
Malware
BeaverTailThe group used malware strains such as BeaverTail, OtterCookie and InvisibleFerret, lured targets with fake LinkedIn job offers and generative-AI-created companies, and operated infrastructure to exfiltrate credentialsInvisibleFerretThe group used malware strains such as BeaverTail, OtterCookie and InvisibleFerret, lured targets with fake LinkedIn job offers and generative-AI-created companies, and operated infrastructure to exfiltrate credentialsOtterCookieThe group used malware strains such as BeaverTail, OtterCookie and InvisibleFerret, lured targets with fake LinkedIn job offers and generative-AI-created companies, and operated infrastructure to exfiltrate credentials