Suspected DPRK Threat Actors Compromise Crypto Firms, Steal Keys and Cloud Assets in Coordinated Attacks

A coordinated campaign, likely linked to North Korean state-sponsored actors, targeted multiple tiers of the cryptocurrency supply chain—staking platforms, exchange software providers, and exchanges—using a mix of web-app exploitation (CVE-2025-55182) and pre-obtained AWS tokens to enumerate cloud infrastructure, extract private keys and source code, and exfiltrate Docker images and Terraform state files; attackers used Kubernetes pivots, tunneled C2 over DNS and IPv6, and left evidence in exposed open directories that revealed the full kill chain and tooling.