Key Takeaways

• Ripple is sharing internal threat data via Crypto ISAC to help firms identify North Korean (DPRK) hacking tactics.

• 2026 has seen a shift toward patient social engineering attacks, accounting for 76% of all crypto theft value this year.

• The data includes known fraudulent domains, crypto wallets, and specific profiles of suspected state-sponsored IT workers.

In a year where just a “handful” of attacks have resulted in over $577 million in losses, the crypto industry is finally realizing that security is a team sport. Ripple has stepped up as a primary contributor to Crypto ISAC, a non-profit cybersecurity collective, to share high-level threat intelligence regarding North Korean operatives.

The goal is to move beyond simple lists of bad addresses and provide the “contextual enrichment” necessary to spot sophisticated, state-directed financial operations before they can drain a protocol.

Fortifying the Ecosystem Against State-Sponsored Attacks

Hacks aren’t just about code anymore. In 2026, North Korean teams have mastered the art of the long con, using social engineering to bypass the strongest security. The proof is in the April exploits of Drift and KelpDAO. These two events were responsible for the vast majority of crypto losses this year.

They weren’t just hacks; they were a massive signal that the industry’s biggest weakness is no longer the software, but the people running it. Attackers are no longer just looking for bugs; they are befriending contributors and embedding themselves as “IT workers” within crypto firms. Ripple’s data sharing aims to disrupt these infiltration attempts by providing the industry with actionable Indicators of Compromise (IOCs) derived from active campaigns.

Ripple Unveils “Enriched” Profiles of DPRK Operatives

The intelligence shared by Ripple includes detailed profiles of suspected operatives who use fake identities to land jobs at crypto companies. By tracking the domains, wallets, and communication patterns associated with these actors, Ripple and Crypto ISAC are providing a proactive shield for DeFi developers.

While some defensive measures, like Arbitrum’s recent freezing of 30,000 ETH, have sparked debate over decentralization, the consensus is shifting toward the “gold standard” of shared security. In an era where hackers act with the scale and speed of a financial institution, a siloed defense is no longer an option.

Final Thoughts

Ripple’s contribution proves that even in a competitive market, security must be a collaborative effort. When state-sponsored actors are the threat, information is the most valuable currency.

Frequently Asked Questions

What is Crypto ISAC?
It is a non-profit organization dedicated to sharing cybersecurity threat intelligence within the crypto industry.

How much has been stolen by the DPRK in 2026?
Approximately $577 million, which is 76% of all crypto losses so far this year.

What is an “enriched profile”?
It’s a dataset that includes not just a wallet address, but the behavior, domains, and tactics used by a specific hacker.