Web developers 26,584 cryptocurrency wallets on 2,726 infected systems

Date (as written): 22/04/2026
Year: 2026
Country: Global
Actors (as written): Famous Chollima (a.k.a. HexagonalRodent)
Actor pages: Famous Chollima
Tags (as written): Attack: Malware; Target Class: Finance/Insurance; Attack Class: Cyber Espionage Cyber Crime; Initial Access: T1204.002 - User Execution: Malicious File
Dollar figures (as written): $12M

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Web developers 26,584 cryptocurrency wallets on 2,726 infected systems · 22/04/2026

Researchers at Expel uncover DPRK-linked Famous Chollima (HexagonalRodent) stealing $12M in crypto from developers in Q1 2026 using BeaverTail, OtterCookie and InvisibleFerret malware strains on personal devices. [Date Occurred: Between January and March 2026; Date Discovered: During October 2025]

https://www.hackmageddon.com/2026/05/08/16-30-april-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/e/2PACX-1vTbUD4I3wQ1E1jETF6dbBelX6hJcQlgbij6JChX-YeotprThdKtAQeN9ejPXdVBeiQDhudcNBWK5HlY/pub?gid=1060075184&single=true&output=csv

https://therecord.media/north-korean-hackers-siphon-12-million-from-crypto-users

Expel blog

Inside Lazarus: How North Korea uses AI to industrialize attacks on developers (HexagonalRodent) · 2026-04-22T16:00:15+00:00

Expel is actively tracking an APT group that we assess with high confidence to be North Korean (DPRK) state-sponsored. ... HexagonalRodent primarily targets Web3 developers with the goal of stealing crypto assets.

https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/

Suggest a correction on GitHub