Crypto Startups Beware: That VC Email Might Be North Korean Hackers

Cybersecurity researchers say this North Korean hacker crew likely won’t slow down its crypto-phishing campaign anytime soon

article-image

Sashkin/Shutterstock.com modified by Blockworks

share

Members of a notorious hacker crew with links to North Korea have been posing as venture capitalists in a bid to phish — and steal from — crypto startups.

A subunit of North Korean cyberwarfare agency Bureau 121, called BlueNoroff, has now deployed more than 70 domains during its phishing campaign overall, with a recent focus on Japan’s financial sector.

“[BlueNoroff] created numerous fake domains that look like venture capital and bank domains. Most of the domains imitate Japanese venture capital companies, indicating that the group has an extensive interest in Japanese financial entities,” cybersecurity firm Kaspersky said.

The hackers have imitated venture capital firms such as Beyond Next Ventures and Angel Bridge, as well as banking giants Bank of America and Mizuho Financial Group. 

BlueNoroff has also adopted new malware strains that rely on different file types to bypass Windows system flags, employing .iso and .vhd extensions instead of Word documents. 

The malware, usually delivered via email, is hidden inside those files, which release a malicious PDF or PowerPoint presentation once opened. Additional malware is then downloaded directly to the target machine, installing backdoors and executing commands to steal sensitive data and high system privileges.

The US Army in 2020 estimated that BlueNoroff is made up of roughly 1,700 individuals operating around the world. Authorities say it aims to pull off “financial cybercrime by concentrating on long-term assessment and exploiting enemy network vulnerabilities.” 

“This group exploits the systems for financial gain for the regime or to take control of the system.”

Kaspersky’s researchers have tracked BlueNoroff’s crypto efforts since 2018 — two years after the group attempted to steal $1 billion from the central bank of Bangladesh, though making off with just $63 million.

In January, Kaspersky detailed instances of the hackers pretending to be Barry Silbert’s crypto hedge fund Digital Currency Group in phishing attempts, among numerous other digital asset firms including Emurgo, a Cardano-focused software firm, and Ant Capital.

Fake BlueNoroff phishing document cites purported investments in crypto exchange bitFlyer

Fellow Bureau 121 subunit Lazarus Group is believed to be responsible for major hacks on crypto startups, including the $500 million Axie Infinite and $100 million Harmony incidents this year.

BlueNoroff itself has been responsible for crypto thefts worth millions of dollars from crypto startups, Kaspersky has said.

The reports align with others from October, in which Japanese authorities disclosed a spate of Lazarus-linked phishing and social engineering attacks on local crypto funds, some of which amounted to lost capital.

“As we can see from our latest finding, this notorious actor has introduced slight modifications to deliver their malware. This also suggests that attacks by this group are unlikely to decrease in the near future,” researchers said.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Research Report Templates.png

Research

The convergence of DePIN and energy generation aims to address modern grid challenges by incentivizing distributed generation.

article-image

Blockworks Research uses numbers to help crypto advance to a higher stage of storytelling

article-image

While Arizona’s governor could veto another crypto reserve bill, similar North Carolina and Texas laws are approaching the finish line

article-image

However, they noted there’s now an increased risk that unemployment and inflation will rise in the coming months. 

article-image

The network’s most ambitious upgrade since the Merge brings validator streamlining, smart account UX and doubled blobspace to Ethereum

article-image

Debate over extra Bitcoin use cases has returned, two years on from Ordinals