BitMEX said it has thwarted an attempted phishing attack by the Lazarus Group, describing the attempt as using “unsophisticated” phishing methods by the notorious North Korea-linked group.

In a blog post published on May 30, the crypto exchange detailed how an employee was approached via LinkedIn under the guise of a Web3 NFT collaboration. 

The attacker tried to lure the target into running a GitHub project containing malicious code on their computer, a tactic the firm says has become a hallmark of Lazarus’ operations.

“The interaction is pretty much known if you are familiar with Lazarus’ tactics,” BitMEX wrote, adding that the security team quickly identified the obfuscated JavaScript payload and traced it to infrastructure previously linked to the group.

A likely failure in operational security also revealed that one of the IP addresses linked to North Korean operations was located in the city of Jiaxing, China, approximately 100 km from Shanghai.

“A common pattern in their major operations is the use of relatively unsophisticated methods, often starting with phishing, to gain a foothold in their target’s systems,” BitMEX wrote.

Examining other attacks, it was noted that North Korea’s hacking efforts were likely divided into multiple subgroups with varying levels of technical sophistication. 

“This can be observed through the many documented examples of bad practices coming from these ‘frontline’ groups that execute social engineering attacks when compared to the more sophisticated post-exploitation techniques applied in some of these known hacks,” it said.

The Lazarus Group is an umbrella term used by cybersecurity firms and Western intelligence agencies to describe several hacker teams operating under the direction of the North Korean regime.

In 2024, Chainalysis attributed $1.34 billion in stolen crypto to North Korean actors, accounting for 61% of all thefts that year across 47 incidents, a record high and a 102% increase over 2023’s total of $660 million stolen.

Still a threat

But as founder and CEO of Nominis, Snir Levi warns, growing knowledge of the Lazarus Group’s tactics doesn’t necessarily make them any less of a threat. 

“The Lazarus Group uses multiple techniques to steal cryptocurrencies,” he told Decrypt. “Based on the complaints we collect from individuals, we can assume that they are trying to defraud people on a daily basis.”

The size of some of their hauls has been shocking. 

In February, hackers drained over $1.4 billion from Bybit, made possible by the group tricking an employee at Safe Wallet into running malicious code on their computer. 

“Even the Bybit hack started with social engineering,” Levi said. 

Other campaigns include Radiant Capital, where a contractor was compromised via a malicious PDF file that installed a backdoor.

The attack methods range from basic phishing and fake job offers to advanced post-access tactics like smart contract tampering and cloud infrastructure manipulation.

The BitMEX disclosure adds to a growing body of evidence documenting Lazarus Group’s multi-layered strategies. It follows another report in May from Kraken, in which the company described an attempt by a North Korean to get hired.

U.S. and international officials have said North Korea uses crypto theft to fund its weapons programs, with some reports estimating it may supply up to half of the regime’s missile development budget.

Edited by Sebastian Sinclair

Bitcoin’s price will more than double within the next six months, swelling to $250,000, according to Bitcoin billionaire and BitMEX co-founder Arthur Hayes, as U.S. President Donald Trump moves away from the market-rattling impact of tariffs toward other fiscal policies.

“Midterm elections are coming up in the U.S.,” he told Decrypt at Bitcoin 2025 in Las Vegas. “While the Trump administration went hard on tariffs and was taking this market pain for the last three months, that narrative has to shift.”

Instead of pursuing trade policies that could weigh on economic growth and potentially hurt Americans’ ability to afford everyday goods, Hayes—who has made his fair share of bold predictions—argued that the president will have to show he “brought goodies for the population” to help Republicans at the ballot box come 2026.

“They’re going to accelerate the money printing,” Hayes said, referring to the Federal Reserve—an independent government agency that is primarily responsible for managing the U.S. money supply.

Among policies that U.S. Treasury Secretary Scott Bessent has teased as fiscal stimulus, Hayes highlighted potential changes to Fannie Mae and Freddie Mac, government-backed mortgage giants that have been under government oversight since the 2008 financial crisis.

If the government-sponsored enterprises are allowed to go public and raise capital again, that would inject cheap liquidity into the housing market, Hayes said. Allowing them to “lever up their balance sheets” would also make mortgages more affordable, he said. Among knock-on effects, increased housing activity could theoretically spur economic growth and support risk-on assets.

On top of that, discussions surrounding a so-called supplemental leverage ratio, or SLR, exemption for U.S. Treasuries are bullish, Hayes said. In essence, the White House wants to ease leverage ratios for banks when it comes to their exposure to U.S. debt.

“That allows the U.S. banking system to apply infinite leverage to buy treasury bonds is obviously very positive for global capital markets,” he added.

Finally, Hayes sees the government shifting from tariffs to capital controls to support American manufacturing in a more politically palatable way. Instead of taxing imports, the U.S. could tax foreign government holdings of bonds, equities, and land that stem from trade long-running trade imbalances.

How that could drive governments toward gold and Bitcoin is a central theme of his latest essay, which also predicts that Bitcoin will hit $1 million before 2028. Earlier this month, Hayes predicted that Bitcoin would hit $150,000 this year, as opposed to $250,000.

Billionaire investor Tim Draper made a similar call this month, highlighting regulatory tailwinds for the asset under the Trump administration. Bitcoin’s path to $250,000 this year will also be bolstered by myriad firms adopting Bitcoin as a treasury reserve asset, he said.

With Congress weighing legislative initiatives that could potentially establish rules for stablecoins and create a regulatory taxonomy for many coins, Hayes also told Decrypt that Ethereum will make its own comeback this year, rising as high as $5,000.

Edited by James Rubin

In 2009, the webcomic xkcd published a strip that laid out one of the most chillingly simple concepts in cybersecurity: the “$5 wrench attack.” In the comic, a stick figure explains how to bypass sophisticated encryption—not with code or brute force, but by threatening someone with a $5 wrench until they give up their password.

Sadly, the $5 wrench attack is no longer a punchline. Far worse attacks are happening in real life, with alarming frequency. Criminals aren’t bothering to hack private keys or compromise seed phrases—they’re simply knocking on doors, kidnapping crypto holders, and demanding access to wallets, often with violence.

The most recent attack occurred a few days ago in Uganda, when Mitroplus Labs founder Festo Ivaibi was reportedly abducted near his home and forced at gunpoint to transfer crypto worth roughly half a million dollars.

In France, a series of horrific kidnappings and attempted abductions have alarmed the crypto community. Notably, the father of a cryptocurrency entrepreneur was kidnapped in Paris earlier this month, with his finger severed to pressure a ransom payment of €5–7 million in cryptocurrency. He was rescued after a two-day ordeal, and five suspects were arrested. In another incident, the pregnant daughter of a crypto CEO and her child were targeted in a daylight kidnapping attempt in Paris, which was thwarted by passersby. That was one of six attacks that have occurred there since January.

In the United States, three teenagers kidnapped a Las Vegas man in November after he hosted a crypto conference, and drove him 60 miles away into the Mojave Desert, where they demanded access to his cryptocurrency. They left him there after stealing $4 million in digital assets. Two of the suspects, both 16-year-olds from Florida, were recently apprehended and now face multiple felony charges, including kidnapping and robbery.

With Bitcoin reaching all time highs in recent days, that target on your back is bigger than ever. So what can you do when the weakest link in your security setup is you?

A growing class of tools, wallet setups, and physical protocols are emerging to defend against real-world coercion. Here’s how to start thinking like a crypto-savvy but extremely paranoid billionaire.

1. Multisig Wallets

Multisignature wallets require multiple private keys to authorize a transaction. A common setup is 2-of-3: two keys are needed to move funds, but three exist in total. If an attacker gets access to just one—say, by threatening you—then they still can’t drain your holdings.

Tools like Nunchuk and Casa allow users to split keys across locations (one at home, one in a bank vault, and one with a lawyer, for instance), making instant theft impossible.

Potential downside: The attackers can simply force you to beg one of the other keyholders to authorize the transaction.

2. Shamir’s Secret Sharing

A number of wallets, including Trezor Model T, support something called “Shamir’s Secret Sharing,” which sounds like the title of a children’s book but is actually a cryptographic algorithm that splits your recovery seed into multiple shards. You can distribute the shards to people or places you trust. Only a threshold number (for example, 3-of-5) of shards is needed to reassemble the key.

Another option is Vault12, which lets you assign guardians—family, lawyers, or business partners—who help you recover your vault only when needed.

Potential downside: Like multisig wallets, SSS is only as secure as your co-seed holders are coercion-proof.

3. Duress Wallets and Decoys

Lots of wallets, such as Blockstream Jade, support so-called “duress PINs.” Enter one PIN and access your real wallet. Enter another—under duress—and it opens a dummy wallet with a modest balance. It can even wipe the device with a secret emergency PIN.

Plausible deniability can be an excellent ploy if you’re a fast talker.

Potential downside: If an attacker has been stalking you online, then they might know that you’re holding millions, rather than the $267 that shows up in your decoy wallet.

4. Hiding your tracks

A great way to avoid an attack is to not look like a target in the first place. Privacy-preserving tools can reduce your visible footprint on the blockchain. The Monero (XMR) cryptocurrency, for example, uses stealth addresses and ring signatures to make transactions virtually untraceable (getmonero.org). Bitcoin wallets like Wasabi implement CoinJoin, a technique that mixes coins with others to obfuscate origins.

Potential downside: It’s fairly easy to figure out who’s a player in big crypto, whether they try to hide their riches or not.

5. Proximate and Remote Wipe

A number of good hardware wallets, including Trezor and Ledger, offer this feature, which can be invoked in a number of ways, including inputting a special PIN that immediately bricks your wallet. The Samourai wallet, once renowned for its extraordinary security until the Feds shut it down and arrested the founders for suspected money laundering, supported remote wipe via sending a special SMS. If you know what you’re doing, you can find the Samourai software from repositories on the internet and invoke that feature.

Potential downside: Bricking a wallet while someone has a gun to your head is risky; SMS texts can be intercepted.

6. Air-Gapped Hardware Wallets

Your average crypto billionaire keeps their crypto in one or more hardware wallets. And if they keep them in their homes rather than safe deposit banks or secret bat-caves, then they are well hidden. Devices like COLDCARD and Keystone Pro use QR codes or SD cards for signing transactions offline. Even if an attacker has your laptop, then they still need the physical device, PIN, and (usually) another co-signer.

Potential downside: A highly motivated and violent thief likely has ways to force you to access your hardware wallet. We’ve all seen the movies.

7. Wearable Panic Buttons with GPS Tracking

Compact, wearable emergency buttons have been around forever. They were invented for your garden variety, paranoid high net-worth individual, not crypto people. Devices such as Silent Beacon can call any phone number, and send alerts with the user’s GPS location to designated contacts. It also features two-way communication, allowing the victim to talk to their prospective rescuers.

Potential downside: Wearing a panic button signals to a potential bandit that you indeed are protecting something valuable.