THORchain Co-Founder Falls Victim to North Korean Zoom Scam

North Korean hackers have launched a sophisticated cyberattack on the crypto industry, resulting in a significant loss for THORchain co-founder JP Thor, who lost approximately $1.3 million. This incident has highlighted the growing threats posed by cybercriminals using deepfake technology and social engineering tactics to exploit high-value targets within the cryptocurrency space.

Key Takeaways

JP Thor, co-founder of THORchain, lost $1.3 million to a North Korean cyber scam.
The attack was initiated through a compromised Telegram account leading to a Zoom call with a deepfake impersonation.
Hackers exploited a vulnerability to steal Thor's wallet keys without alerting him.
A bounty has been offered for the recovery of the stolen funds, with a promise of no legal repercussions if they are returned within 72 hours.
The increase in deepfake and social engineering attacks targeting crypto executives is a growing concern in the industry.

THORchain co-founder loses $1.3m to North Korean zoom scam - 1

Main Content

North Korean hackers are continuing their targeting of the cryptocurrency sector, this time directly impacting the co-founder of THORchain in a highly sophisticated operation. A recent alert from the blockchain security firm PeckShield indicates that JP Thor lost about $1.3 million due to this cyber attack. Following the incident, Thor shared a detailed account on X, including screenshots, describing how the scam unfolded.

The attack began when Thor was lured into a Zoom call from a friend whose Telegram account had been hacked. The call seemed legitimate, featuring a convincing deepfake video of his friend. However, during the brief two-minute interaction, a malicious script was triggered without Thor's knowledge, leading to significant data breaches.

The malicious script started copying his iCloud documents to a temporary directory, allowing the attackers to access sensitive information quietly. Thor subsequently realized that his MetaMask wallet had been compromised. His wallet, linked to an inactive Chrome profile and stored in his iCloud Keychain, was drained without any alert or admin access prompts. Thor suspects that the hackers exploited an undisclosed zero-day vulnerability to infiltrate his system and extract the wallet keys.

In an attempt to retrieve the stolen assets, the THORchain team has offered a bounty for their return. A blockchain message related to the compromised wallet specifies that a reward will be provided for the assets' recovery, assuring no legal actions will occur if the funds are returned within 72 hours.

This method mirrors a more extensive trend observed earlier this year, with North Korean-linked groups increasingly employing deepfakes, social engineering, and advanced malware to breach high-value targets in the crypto domain.

North Korean Hackers’ Tactics Against Crypto Executives

Earlier in the same year, numerous crypto executives encountered similar tactics involving deepfake impersonations during video calls, leading to substantial financial losses. These attacks utilized advanced strategies that often included AI-assisted voice or video disguises, malicious update prompts, and compromised device security.

The regularity of these attacks prompted warnings from security professionals and figures within the industry. They advised that video verification should now be approached with skepticism, as seeing a familiar face or hearing a known voice can no longer be taken as reliable indicators of trust given the prevalence of AI deepfakes.

Throughout this year, North Korea-linked cyber groups have increased their attacks on both institutions and individuals in the cryptocurrency arena. The extent of the thefts has already reached billions of dollars, with tactics evolving beyond traditional exchange hacks and deepfake Zoom calls to include fake job offers, identity fraud, and developer network infiltrations.

The most notable theft was the $1.5 billion breach from Bybit in February, which TRM and law enforcement officials have confidently linked to North Korea. This single incident represents a significant portion of the $2.17 billion in losses reported thus far this year in cryptocurrency theft.