Aikido Security blog
North Korean Crypto-Heist Targets Web3 Developers via Malicious NPM Package (web3-wrapper-ethers) · Jun 12, 2025
Malicious crypto-theft package targets Web3 developers in North Korean operation ... Last week, our automated malware analysis pipeline flagged a suspicious package web3-wrapper-ethers . The package impersonates the popular ethers library and contains obfuscated code designed to steal private keys. Our investigation revealed that the package may be associated with the threat actor known as Void Dokkaebi , a group known for stealing cryptocurrency from developers involved in the development of web3, blockchain, and cryptocurrency technologies.