Bitcoin Security Alert After Hackers Breach 1,640 Firms

Crypto News

Bitcoin (BTC) custody and the wider crypto stack are under renewed security scrutiny after a 22-month investigation found that North Korean-linked attackers infiltrated 1,640 companies across 57 countries through fabricated hiring conversations. The researcher, Vangelis Stykas, chief technology officer at cybersecurity firm Kumio, outlined a campaign in which developers and remote technology contractors received plausible job offers, technical tests, or sample projects. When the supplied files were opened or executed, malware established an initial foothold inside the target's environment. The disclosure emphasized that this was not ordinary phishing aimed at a broad inbox list; it was a focused social-engineering operation that used the trust normally given to recruitment. Once inside, the attackers pursued the credentials that matter most to digital-asset teams: administrator access to servers, Amazon Web Services permissions, and private keys controlling Bitcoin (BTC), an altcoin, or an AI crypto wallet setup. The investigation found that roughly 700 to 800 organizations experienced severe compromises, where the intruders could move through systems, inspect cloud infrastructure, and potentially direct funds. For Bitcoin (BTC), the risk is especially unforgiving because transactions cannot be reversed once confirmed. If a private key is exposed, the associated coins can be transferred without recourse, making preventive custody controls more important than reactive recovery. The findings also pointed to excessive contractor permissions as a recurring weakness. External developers often held broader access than their tasks required, allowing one infected account to become a pathway into critical systems. Recruitment channels such as professional-network messages, code-repository invitations, and interview files should be treated as untrusted input. Companies should require multi-factor authentication, segregate contractor machines from production, and perform recurring permission audits before granting access to keys or cloud roles. The practical lesson for exchanges, custodians, and blockchain startups is that security reviews must cover hiring workflows, endpoint hygiene, and least-privilege enforcement, not only the blockchain layer itself.

The Black Hat disclosure added a second layer of concern by showing how commercial AI utilities are lowering the barrier for less-experienced attackers. Stykas said he was able to examine the operation after the intruders accidentally infected one of his own systems, giving him a route into their command-and-control servers, private Slack and Discord channels, and nearly five terabytes of internal material. That vantage point revealed that the group used mainstream AI services to draft malicious code, polish fake recruiting sites, and automate parts of the intrusion cycle, much like an AI trading bot automates market decisions. Visible artifacts, such as English comments and emojis buried in malicious code, pointed to generated text, while separate threat-intelligence work on a cluster known as UNC2970 described the use of Gemini to research targets and identify high-paying roles in defense and technology. The affected list included prominent crypto names. Coinbase stated that the matter involved a contractor, was investigated and terminated within 30 days, and did not expose customer data. Uniswap Labs was also named, while Boston Children's Hospital said the issue related to a former contractor's personal device rather than core hospital systems. The freelance model amplified the damage: one developer working for multiple clients can become a single point of failure across many organizations. The researcher identified individuals whose compromised machines unintentionally provided access to as many as 30 companies at once. On-chain analytics presented alongside the findings estimated that North Korean-linked actors accounted for about 76% of crypto value stolen in April, roughly $577 million, across two major thefts. Since 2017, the cumulative theft attributed to North Korean crypto operations is estimated at more than $6 billion. Those figures turn the incident from a single research alert into a structural warning for every team holding Bitcoin (BTC), an altcoin, or stablecoin inventory.

COINOTAG's assessment is that the root cause is identity and access failure rather than a flaw in Bitcoin (BTC) or any underlying blockchain. The closest available post-mortem consists of affected-company incident statements and on-chain analytics, not a protocol-level disclosure. No attacker transaction hashes or drained-address breakdowns have been published in this research, which limits definitive fund tracing. Even when markets are not chasing an all-time high, custody hygiene remains the decisive variable. The remediation path is clear: treat recruitment files as untrusted input, enforce least privilege, segregate contractor endpoints, require multi-factor authentication, and audit key-access events continuously. Irreversible settlement means prevention, not recovery, remains the only reliable defense.