
North Korean Hackers Pose as IT Workers, Steal Nearly $1 Million from NFT Projects
2025-06-28
Author: Yu
The Great NFT Heist
In a shocking turn of events, hackers disguised as IT staff have infiltrated NFT projects, absconding with almost $1 million in assets. These audacious cybercriminals are linked to North Korean groups, which now account for 70% of all cryptocurrency thefts in 2025, including the infamous $1.5 billion Bybit hack.
How the Hackers Operated
This latest wave of attacks has sent ripples through the Web3 ecosystem. By masquerading as legitimate tech personnel, these hackers gained unauthorized access to prominent NFT collections such as those related to Matt Furie, the creator of Pepe. Once inside, they manipulated minting systems to generate vast quantities of tokens, selling them off en masse and triggering a dramatic drop in market value.
Inside the Exploit: A Detailed Timeline
According to on-chain analyst ZackXBT, the breach at Replicandy started on June 18, with the transfer of contract ownership to a new address. This account, 0x9Fca, then withdrew mint proceeds and continued minting, flooding the market and effectively crashing the floor price. A similar tactic was employed on June 23, targeting additional collections like Peplicator and Hedz, leading to losses exceeding $310,000.
Tracing the Stolen Funds
Investigators traced the stolen assets through various wallets, revealing USDT deposits sent to the crypto exchange MEXC. Clues from two suspicious GitHub accounts – 'devmad119' and 'sujitb2114' – were linked to the hack, raising eyebrows as developers claimed U.S. residency while using Korean language settings and operating from Asian/Russian time zones.
The Bigger Picture: North Korea's Cyber Warfare
This incident is part of a larger pattern, with North Korean-linked hackers becoming increasingly aggressive in 2025. Research shows they are responsible for over $1.6 billion in stolen cryptocurrency this year alone. The Bybit breach, the largest in history, appears to be orchestrated by these state-sponsored entities.
A Global Response to Cyber Threats
In the wake of these attacks, countries worldwide are tightening regulations around cryptocurrency. The U.S. government, under the Trump administration, is pushing for pro-crypto policies aimed at protecting the industry from discriminatory banking practices. Simultaneously, Australia is cracking down on crypto ATMs, enforcing stricter transaction caps and identity checks.
Final Thoughts
As the world grapples with the ramifications of these breaches, the silence from key figures, notably Matt Furie, raises more questions about the broader implications for the crypto landscape. The escalating tactics of North Korean hackers underline an urgent need for enhanced security measures in the rapidly evolving Web3 environment.