Crypto Startups Beware: That VC Email Might Be North Korean Hackers

Cybersecurity researchers say this North Korean hacker crew likely won’t slow down its crypto-phishing campaign anytime soon


Sashkin/ modified by Blockworks


Members of a notorious hacker crew with links to North Korea have been posing as venture capitalists in a bid to phish — and steal from — crypto startups.

A subunit of North Korean cyberwarfare agency Bureau 121, called BlueNoroff, has now deployed more than 70 domains during its phishing campaign overall, with a recent focus on Japan’s financial sector.

“[BlueNoroff] created numerous fake domains that look like venture capital and bank domains. Most of the domains imitate Japanese venture capital companies, indicating that the group has an extensive interest in Japanese financial entities,” cybersecurity firm Kaspersky said.

The hackers have imitated venture capital firms such as Beyond Next Ventures and Angel Bridge, as well as banking giants Bank of America and Mizuho Financial Group. 

BlueNoroff has also adopted new malware strains that rely on different file types to bypass Windows system flags, employing .iso and .vhd extensions instead of Word documents. 

The malware, usually delivered via email, is hidden inside those files, which release a malicious PDF or PowerPoint presentation once opened. Additional malware is then downloaded directly to the target machine, installing backdoors and executing commands to steal sensitive data and high system privileges.

The US Army in 2020 estimated that BlueNoroff is made up of roughly 1,700 individuals operating around the world. Authorities say it aims to pull off “financial cybercrime by concentrating on long-term assessment and exploiting enemy network vulnerabilities.” 

“This group exploits the systems for financial gain for the regime or to take control of the system.”

Kaspersky’s researchers have tracked BlueNoroff’s crypto efforts since 2018 — two years after the group attempted to steal $1 billion from the central bank of Bangladesh, though making off with just $63 million.

In January, Kaspersky detailed instances of the hackers pretending to be Barry Silbert’s crypto hedge fund Digital Currency Group in phishing attempts, among numerous other digital asset firms including Emurgo, a Cardano-focused software firm, and Ant Capital.

Fake BlueNoroff phishing document cites purported investments in crypto exchange bitFlyer

Fellow Bureau 121 subunit Lazarus Group is believed to be responsible for major hacks on crypto startups, including the $500 million Axie Infinite and $100 million Harmony incidents this year.

BlueNoroff itself has been responsible for crypto thefts worth millions of dollars from crypto startups, Kaspersky has said.

The reports align with others from October, in which Japanese authorities disclosed a spate of Lazarus-linked phishing and social engineering attacks on local crypto funds, some of which amounted to lost capital.

“As we can see from our latest finding, this notorious actor has introduced slight modifications to deliver their malware. This also suggests that attacks by this group are unlikely to decrease in the near future,” researchers said.

Don’t miss the next big story – join our free daily newsletter.


Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

Mon - Wed, March 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience: Attend expert-led panel discussions and fireside chats Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts.

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Top Icon.png


Osmosis thrived in H2 2023 on the back of increased DeFi activity deriving from recently launched Cosmos-related projects and better market conditions. With new value accrual mechanisms for the native token, Osmosis is well-positioned to continue its strong performance in 2024.



Though the opposing flow trend is likely to slow over time, industry watchers note, bitcoin fund assets could one day eclipse the $90 billion gold ETF space


Celestia had the first mover advantage. EigenDA has staked ether. What sets Avail apart?


Bitcoin moved 1% higher Monday morning in New York, Matrixport analysts say $62,000 could happen next month


It’s hard to believe right now that crypto — even with all of its flexibility and massive capabilities — could ever be like cash on the internet


Michael Saylor announced Monday morning that MicroStrategy bought 3k more bitcoin after the X account was compromised over the weekend


Plus, Pudgy Penguins grows its brand and a group of Autoglyphs sell for $14.5 million