Bitcoin Flow Alert: $577M North Korean Heists Just Raised the Threat to Crypto Users

North Korea's share of crypto thefts is rising because the big thefts are becoming more concentrated

This is mainly a capital-flow story. Roughly $577 million was taken in just two DeFi attacks this year, which makes the threat less about scattered crime and more about concentrated gains through a small number of exploit paths.

That point gets sharper when you look at the wider market. About $643 million was stolen in H1 2026, even as total hack losses fell to $972 million from $2.3 billion. Fewer large thefts happened across crypto, so North Korea's haul represented a larger share by default. TRM Labs said the decline in overall losses does not mean the threat has eased, because one successful strike against a major target can still outweigh months of losses from all other attackers combined.

The immediate danger, then, is not only what was stolen in the past. It is how the attackers are gaining the access that makes future drains possible. Mandiant traced one intrusion to a compromised Telegram account used to reach a new victim, then to a fake Zoom meeting, a ClickFix setup, and ultimately seven unique malware families on a single host. That toolkit points to one clear goal: harvest credentials, browser data, and session tokens to support financial theft.

The attack hides inside normal business workflows

The new risk is not that crypto is "less secure" in some abstract sense. It is that the intrusion now disguises itself inside a trusted workflow: a Telegram message, a calendar invite, and what appears to be a routine video call. Mandiant said the campaign used a spoofed Zoom meeting hosted on the threat actor's infrastructure, not a real Zoom room. That shifts the problem from software patching to human judgment.

Why the social-engineering chain works

Bulls may argue that verified channels still matter: if you only engage through known contacts and known platforms, you should be safer. But this campaign shows how quickly that assumption can break. UNC1069 started with a compromised Telegram account, moved to a fake meeting-invite flow, and used a video that was reported to be an AI-generated video. Researchers said they could not independently verify the deepfake in this specific case, so the claim should be treated carefully. Still, the broader mechanism is well documented: the lure only has to look credible long enough to make the victim cooperate.

Once inside the fake meeting, the victim was told there were audio problems and then guided through a ClickFix-style setup. In practice, the attacker created a fake technical issue and asked the victim to run commands to "fix" it. Trust produces the meeting. The meeting produces the technical excuse. The excuse opens the machine.

The journalist near-miss shows how aggressive the lures have become

A useful stress test is the near-miss experienced by a Fortune writer. A process on a colleague's laptop was reported to be able to monitor keyboard strokes, record the screen, see passwords, and access apps. The writer shut the machine down and went to have it wiped rather than trying to debug it live.

That matters because it shows what UNC1069 is counting on: busy professionals reacting quickly inside what feels like a legitimate collaboration flow.

Watch these trust-failure points: - Telegram contacts resurfacing from old conversations. Mandiant traced one campaign to a hijacked Telegram profile. - Meeting links that route to infrastructure built by the attacker, not the real vendor. - Any call that immediately blames audio problems and asks you to run instructions on your device.

Investors should watch access risk and laundering pathways, not just headline hack numbers

The more measured stance is defensive flow management, not blanket liquidation. Chainalysis identifies a 45-day laundering cycle following major thefts, and THORChain processed the vast majority of proceeds from both the Bybit breach and the KelpDAO hack. That suggests the next market reaction could be concentrated around access points and routing channels while stolen funds are still moving, rather than hitting every token equally.

The bearish case is therefore selective. Trust-dependent workflows can lose credibility quickly if another drain lands, and platforms connected to known money-movement paths may come under more scrutiny. Mandiant traced the current campaign through a compromised Telegram account, a Calendly link, and a spoofed Zoom meeting hosted on the threat actor's infrastructure, ending with seven unique malware families aimed at harvesting credentials, browser data, and session tokens. That is primarily an access-layer threat, but one with clear capital-flow consequences.

What to watch before the next repricing

• Telegram-sourced meeting invites, especially fresh Calendly links or sudden resurrections of old chats.
• Unexpected support or partner sessions that quickly pivot to remote setup instructions.
• Any incident flagged as a credential grab or session-token harvest.

• Unusual exchange outflows or elevated activity through laundering paths already tied to major breach proceeds, including THORChain.

• The watch case stays relevant as long as inflow data continue to show capital moving through identifiable post-exploit routes.

• Invalidation: isolated access-side incidents plus real friction on laundering channels would reduce contagion risk.