BlockThreat - Week 39, 2026

Two platform compromises on the same day: Bitget ($387.5M) and Duelbits ($7M). DPRK is responsible for Bitget. No one has confirmed who is behind the Duelbits breach, but North Korea was behind its previous $4.6M hack in 2024. While we wait for detailed post-mortems, I'm stunned by how much criminal activity this week involves DPRK: more Contagious Interview campaigns, an Indian IT provider hack, and others. Multiple DPRK military and intelligence units are pillaging the crypto ecosystem with the brazen impunity only a nuclear-armed nation state can afford. So what can we do?

Ever since North Korea showed off its cyber prowess by knocking Sony Pictures back to the age of fax machines in 2014, there has been an open debate about the response, ranging from sanctions to kinetic strikes. Following the hack, we got more ineffective sanctions on an already heavily sanctioned pariah state and criminal charges against a few individuals who will never see a courtroom. Then came sequels like the nearly $1B Bangladesh Bank heist in 2016 (which still netted $81M), the attempted $110M Bancomext job in 2018, the failed $2B FASTCash ATM cashouts in 2020, and more. Sanctions followed, but North Korea only grew more convinced it was untouchable after Russia used its veto in 2024 to kill the UN panel that tracked Pyongyang's money laundering.

Traditional financial institutions didn't wait for government or law enforcement intervention. SWIFT learned its lesson and enforced a series of security standards like segregated networks, 24/7 incident response hotlines, better monitoring, money-laundering controls, and shared threat intelligence. Boring stuff, but it worked. By 2020, most of DPRK's attempts against banks were failing, so it rationally went hunting somewhere else.

Enter the cryptocurrency industry. Our ecosystem is less regulated, less mature, and less secure, and oh boy, did North Korea reap the rewards. Gone are the days when an attentive bank employee could spot a typo in a spoofed SWIFT transfer order and stop a billion dollar hack. The many near misses in tradfi were replaced with blockbusters like the $1.5B Bybit hack, $625M Ronin bridge incident, and now $387.5M stolen from Bitget. Hundreds of millions per job, instead of the puny $10M they finally managed to squeeze out of some bank in Chile.

And how did the cryptocurrency industry respond to almost 10 years of looting? We wrote a couple of standards like CCSS and mostly ignored them. Exchanges and projects still define their own idea of what it means to be safe while living under a constant existential threat where all of their liquidity could be drained, either in a direct hack or as a secondary victim.

Did we at least agree on freezing laundered funds where possible? No. We are too busy arguing over decentralization principles and court orders or just being negligent. In Politics as a Vocation, Max Weber distinguished an ethic of ultimate ends vs. an ethic of responsibility where "one has to give an account of the foreseeable results of one's action". When it comes to freezing funds, we have mostly chosen the first and DPRK has been more than happy to collect the results.

A shared threat intelligence network? The industry hasn't moved much beyond a few loosely organized Telegram chats. Better hope whoever you're trying to reach is around or your coins are gone forever.

Monitoring and incident response? Week after week, we're still reading detection reports after the hack has already happened with very few cases of early containment or prevention.

I know we can do better. Not through coercion or some centralized regulatory body, but through incentives that reward the projects choosing to invest in safety. Projects today rely on code audits, audit contests, bug bounty programs, and other controls, if not to ensure code safety, then to signal to potential liquidity providers that their funds are less likely to be lost. Unfortunately, these assessments vary wildly in quality and encompass only one part of the total risk model. SEAL's Certifications and Frameworks programs are attempting to close the gap, but there's still a long way to go before investors refuse to entrust their coins to a project which may mix them with North Korean funds or without security programs covering operational, dev, cloud, human, and other security domains.

These and many other challenges are still up in the air, and alongside them is the question of when we will graduate from a niche industry to one that genuinely challenges the traditional financial infrastructure we love to poke fun at. The financial well being of billions is at stake. Don't mess it up.

Let’s dive into the news!