Crypto Startups Beware: That VC Email Might Be North Korean Hackers

Cybersecurity researchers say this North Korean hacker crew likely won’t slow down its crypto-phishing campaign anytime soon

article-image

Sashkin/Shutterstock.com modified by Blockworks

share

Members of a notorious hacker crew with links to North Korea have been posing as venture capitalists in a bid to phish — and steal from — crypto startups.

A subunit of North Korean cyberwarfare agency Bureau 121, called BlueNoroff, has now deployed more than 70 domains during its phishing campaign overall, with a recent focus on Japan’s financial sector.

“[BlueNoroff] created numerous fake domains that look like venture capital and bank domains. Most of the domains imitate Japanese venture capital companies, indicating that the group has an extensive interest in Japanese financial entities,” cybersecurity firm Kaspersky said.

The hackers have imitated venture capital firms such as Beyond Next Ventures and Angel Bridge, as well as banking giants Bank of America and Mizuho Financial Group. 

BlueNoroff has also adopted new malware strains that rely on different file types to bypass Windows system flags, employing .iso and .vhd extensions instead of Word documents. 

The malware, usually delivered via email, is hidden inside those files, which release a malicious PDF or PowerPoint presentation once opened. Additional malware is then downloaded directly to the target machine, installing backdoors and executing commands to steal sensitive data and high system privileges.

The US Army in 2020 estimated that BlueNoroff is made up of roughly 1,700 individuals operating around the world. Authorities say it aims to pull off “financial cybercrime by concentrating on long-term assessment and exploiting enemy network vulnerabilities.” 

“This group exploits the systems for financial gain for the regime or to take control of the system.”

Kaspersky’s researchers have tracked BlueNoroff’s crypto efforts since 2018 — two years after the group attempted to steal $1 billion from the central bank of Bangladesh, though making off with just $63 million.

In January, Kaspersky detailed instances of the hackers pretending to be Barry Silbert’s crypto hedge fund Digital Currency Group in phishing attempts, among numerous other digital asset firms including Emurgo, a Cardano-focused software firm, and Ant Capital.

Fake BlueNoroff phishing document cites purported investments in crypto exchange bitFlyer

Fellow Bureau 121 subunit Lazarus Group is believed to be responsible for major hacks on crypto startups, including the $500 million Axie Infinite and $100 million Harmony incidents this year.

BlueNoroff itself has been responsible for crypto thefts worth millions of dollars from crypto startups, Kaspersky has said.

The reports align with others from October, in which Japanese authorities disclosed a spate of Lazarus-linked phishing and social engineering attacks on local crypto funds, some of which amounted to lost capital.

“As we can see from our latest finding, this notorious actor has introduced slight modifications to deliver their malware. This also suggests that attacks by this group are unlikely to decrease in the near future,” researchers said.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 24 - 26, 2026

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (1).jpg

Research

As AI supercharges surveillance, privacy becomes a prerequisite and the winning stack will combine confidentiality with selective disclosure. Zcash’s Tachyon, composable standards on Ethereum/Solana, and compliance-aware pools aim to make private rails the new norm.

article-image

The derivatives giant will extend futures and options access to round-the-clock trading in early 2026

by Blockworks /
article-image

Global fiber network goes live as SEC clears 2Z token for utility use

by Blockworks /
article-image

The SPAC transaction positions Avalanche Treasury Co. as a Nasdaq-listed vehicle for institutional AVAX exposure by 2026

by Blockworks /
article-image

The collaboration brings regulated money market fund exposure to Polygon, with custody provided by Standard Chartered

by Blockworks /
article-image

FG Nexus teams with Securitize to bring its Nasdaq-listed equity onchain, offering tokenized stock trading through Ethereum

by Blockworks /
article-image

Sponsored

Taiko launches binding onchain governance and appoints three directors with expertise in global regulation, business strategy and blockchain tech

by Sponsored /