Crypto Startups Beware: That VC Email Might Be North Korean Hackers

Cybersecurity researchers say this North Korean hacker crew likely won’t slow down its crypto-phishing campaign anytime soon

article-image

Sashkin/Shutterstock.com modified by Blockworks

share

Members of a notorious hacker crew with links to North Korea have been posing as venture capitalists in a bid to phish — and steal from — crypto startups.

A subunit of North Korean cyberwarfare agency Bureau 121, called BlueNoroff, has now deployed more than 70 domains during its phishing campaign overall, with a recent focus on Japan’s financial sector.

“[BlueNoroff] created numerous fake domains that look like venture capital and bank domains. Most of the domains imitate Japanese venture capital companies, indicating that the group has an extensive interest in Japanese financial entities,” cybersecurity firm Kaspersky said.

The hackers have imitated venture capital firms such as Beyond Next Ventures and Angel Bridge, as well as banking giants Bank of America and Mizuho Financial Group. 

BlueNoroff has also adopted new malware strains that rely on different file types to bypass Windows system flags, employing .iso and .vhd extensions instead of Word documents. 

The malware, usually delivered via email, is hidden inside those files, which release a malicious PDF or PowerPoint presentation once opened. Additional malware is then downloaded directly to the target machine, installing backdoors and executing commands to steal sensitive data and high system privileges.

The US Army in 2020 estimated that BlueNoroff is made up of roughly 1,700 individuals operating around the world. Authorities say it aims to pull off “financial cybercrime by concentrating on long-term assessment and exploiting enemy network vulnerabilities.” 

“This group exploits the systems for financial gain for the regime or to take control of the system.”

Kaspersky’s researchers have tracked BlueNoroff’s crypto efforts since 2018 — two years after the group attempted to steal $1 billion from the central bank of Bangladesh, though making off with just $63 million.

In January, Kaspersky detailed instances of the hackers pretending to be Barry Silbert’s crypto hedge fund Digital Currency Group in phishing attempts, among numerous other digital asset firms including Emurgo, a Cardano-focused software firm, and Ant Capital.

Fake BlueNoroff phishing document cites purported investments in crypto exchange bitFlyer

Fellow Bureau 121 subunit Lazarus Group is believed to be responsible for major hacks on crypto startups, including the $500 million Axie Infinite and $100 million Harmony incidents this year.

BlueNoroff itself has been responsible for crypto thefts worth millions of dollars from crypto startups, Kaspersky has said.

The reports align with others from October, in which Japanese authorities disclosed a spate of Lazarus-linked phishing and social engineering attacks on local crypto funds, some of which amounted to lost capital.

“As we can see from our latest finding, this notorious actor has introduced slight modifications to deliver their malware. This also suggests that attacks by this group are unlikely to decrease in the near future,” researchers said.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Research Report Templates.png

Research

Content Delivery Networks (CDNs) represent low-hanging fruit in a massive market ripe for Web3-driven disruption. The global CDN market was valued at ~$28B in 2024, and is projected to surpass $140B by 2034, (18.75% CAGR) underscoring the immense demand for efficient content delivery.

article-image

Sponsored

Connect in one click from any device to help build a verifiable world and earn rewards

article-image

The Flippening was always a meme, but for a moment it wasn’t so funny

article-image

Frachtis is focused on pre-seed and seed rounds in both consumer apps and AI

article-image

Markets look forward, even when we can’t see past the news

article-image

Solana’s price run might stall as ETH gains institutional favor

article-image

The soccer club is using the XRP-compatible Root blockchain and is expected to release a mobile racing game, too