Unnamed cryptocurrency organization · 09/03/2026
Researchers at Google Threat Intelligence Group (GTIG) reveal that the North Korean threat actor known as UNC4899 is suspected to be behind a sophisticated cloud compromise campaign targeting a cryptocurrency organization in 2025 to steal millions of dollars in cryptocurrency. [Date Occurred: During 2025; Date Discovered: During 2025]
UNC4899 Kubernetes compromise and cryptocurrency theft from a cryptocurrency organization (2025) · Cloud Threat Horizons Report H1 2026 (no exact date on page)
Google Threat Intelligence Group (GTIG) tracked a sophisticated campaign that we assess with moderate confidence was conducted by the North Korean state-sponsored group UNC4899, and targeted a cryptocurrency organization in 2025. ... North Korean actors bypassed traditional network perimeters using social engineering to exploit a personal-to-corporate connection, allowing them to pivot to the cloud and compromise Kubernetes to steal millions in cryptocurrency.