DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

DeltaPrime

Date (as written)
2024-09
Year
2024
Country
Virgin Islands, British
Actors (as written)
Lazarus
Actor pages
Lazarus
Tags (as written)
Cryptocurrency FinancialGain
Dollar figures (as written)
$5.98 million; 5.98 ($ Million)

Source entries (2)

lazarus.day

DeltaPrime · 2024-09
On September 16, 2024, DeltaPrime, a DeFi protocol on Arbitrum, lost $5.98 million due to a private key compromise. The attacker used the compromised admin address to upgrade proxy contracts, inflating their deposits and withdrawing funds in USDC, WBTC, and WETH. The stolen funds were swiftly converted to ETH. DeltaPrime's Avalanche deployment was unaffected, and the team promised coverage from an insurance pool for potential losses. There is speculation of North Korean Lazarus Group involvement.
https://lazarus.day/incidents/deltaprime/

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

DeltaPrime · 2024-09-16
Table 2: DPRK Cryptocurrency Thefts, January - December, 2024. Date: 2024-09-16; Victim: DeltaPrime; DPRK APT: DPRK IT workers; Amount ($ Million): 5.98. Report: "In coordination with Chainalysis and Mandiant, MSMT Participating States have attributed the cryptocurrency heists in tables 2 and 3 to DPRK actors."
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

Suggest a correction on GitHub