North Korean Hackers Steal $1.6B Crypto via Fake Job Offers, Cloud Breaches

North Korean hacking groups, particularly UNC4899 (also known as TraderTraitor, Jade Sleet, and Slow Pisces), have orchestrated large-scale cryptocurrency thefts totaling approximately $1.6 billion in 2025 by exploiting cloud infrastructures and using sophisticated social engineering tactics. Their primary method involves posing as recruiters or industry professionals on platforms like LinkedIn and Telegram, offering fake job opportunities to employees at cryptocurrency firms, which leads victims to run malicious software granting attackers access to sensitive cloud systems and crypto wallets. These groups have evolved their techniques over time, initially embedding malware in open-source software before shifting to elaborate social engineering strategies involving AI-enhanced communication to build trust and avoid detection. They have successfully breached major cloud providers such as Google Cloud and AWS by bypassing multi-factor authentication and stealing session cookies, enabling them to redirect cryptocurrency transactions to wallets under their control. UNC4899 operates in coordination with other North Korea-backed entities like Lazarus Group and APT38, continuously adapting their methods to target the increasingly cloud-dependent crypto industry worldwide. The scale of infiltration is significant, with estimates of nearly a thousand operatives infiltrating crypto firms and earning millions in salaries while stealing billions in digital assets.