The company believes crypto industry security is a shared responsibility.
Ripple is providing its internal data on North Korean threats to Crypto ISAC, a nonprofit organization focused on cybersecurity in the crypto sector, the company announced this week.
Hot topic: Bitcoin on May 5 — BTC Price Hits New Local High Above $81K
The initiative follows two major April attacks: Drift at $285M and Kelp DAO at $292M. Both attacks demonstrated a shift in tactics. Instead of technical exploits, hackers spent months building trust relationships with company employees and infecting their devices with malware.
What Exactly Is Ripple Sharing?
Crypto ISAC reported that Ripple is sharing enriched data, including:
- Domains and wallets linked to fraudulent activity
- Indicators of compromise (IOCs) from active Lazarus Group campaigns
- Profiles of suspected North Korean IT specialists attempting to get hired by crypto companies
“Without shared intelligence, every company starts from zero,” Ripple noted.
Read more: North Korea Calls Crypto Theft Accusations “Absurd Slander” and a US Political Tool
Scale of the Threat
According to TRM Labs, North Korea-linked groups stole approximately $577M in the first four months of 2026. That represents 76% of all crypto industry losses during the period. Since 2017, total damages have exceeded $6B.
“This is a social engineering campaign on a new level,” said Crypto ISAC Director of Growth Kristina Spring.
A new API has also been launched for rapid data sharing among industry participants. Ripple and Coinbase are among the first integrators.
Learn more: What Is Crypto Cybersecurity? The Ultimate Guide to Protecting Digital Assets
