Connect with us
DAPA Banner

Crypto World

North Korean Hackers Deploy AI-Driven Social Engineering on Zerion

Published

on

Crypto Breaking News

Zerion disclosed that North Korean-affiliated hackers used AI-powered social engineering to extract about $100,000 from the company’s hot wallets last week. In a post-mortem published on Wednesday, the crypto wallet provider confirmed that no user funds, Zerion apps, or infrastructure were compromised, and it proactively disabled the web app as a precautionary measure.

Though the amount is modest by crypto-hacking standards, Zerion’s disclosure reinforces a growing trend: attackers are increasingly targeting human operators with AI-enabled techniques. The incident sits alongside a high-profile episode earlier in the month—a $280 million exploit of Drift Protocol attributed to a North Korea–linked operation—illustrating a broader shift in how threat actors approach crypto firms. The human layer, not firmware or smart contracts, has become a primary entry point for incursions into crypto environments.

Key takeaways

  • AI-enabled social engineering is emerging as a principal attack vector for DPRK-linked actors, targeting insiders rather than exploiting code bugs alone.
  • Zerion’s incident involved access to team members’ logged-in sessions, credentials, and private keys held in hot wallets, underscoring a vulnerability in identity and access management.
  • The same threat cluster is tied to a broader pattern of long-running campaigns that impersonate trusted contacts and brands across common collaboration channels such as Telegram, LinkedIn, and Slack.
  • Industry researchers have documented a growing toolbox: fake virtual meetings, AI-assisted image and video editing, and other deceptive tactics that reduce the friction for social engineering.
  • Security analysts warn that the threat extends well beyond exchanges to developers, contributors, and anyone with access to crypto-infrastructure.

AI reshaping the threat landscape

The Zerion incident highlights a shift in how breaches unfold in crypto ecosystems. Zerion stated that the attacker gained access to some team members’ logged-in sessions, credentials, and private keys used for hot wallets. The firm described the event as an AI-enabled social engineering operation, indicating that artificial intelligence tools were deployed to refine phishing messages, impersonations, and other manipulative techniques.

This assessment aligns with earlier findings from industry researchers who have observed DPRK-affiliated groups sharpening their social engineering playbooks. In particular, Security Alliance (SEAL) reported tracking and blocking 164 domains linked to UNC1069 over a two-month window from February to April, noting that the group runs multiweek, low-pressure campaigns across Telegram, LinkedIn, and Slack. The actors impersonate known contacts or reputable brands or leverage access to previously compromised accounts to build trust and escalate access.

“UNC1069’s social engineering methodology is defined by patience, precision, and the deliberate weaponization of existing trust relationships.”

Google’s security arm, Mandiant, has detailed the group’s evolving workflow, including a documented use of fake Zoom meetings and AI-assisted editing of images or videos during the social engineering stage. The combination of deception and AI tools makes it harder for recipients to differentiate legitimate communications from fraudulent ones, increasing the likelihood of successful intrusions.

Advertisement

The DPRK threat surface expands beyond exchanges

Beyond the Zerion case, researchers have emphasized that North Korean threat actors have embedded themselves in crypto ecosystems for years. MetaMask developer and security researcher Taylor Monahan noted that DPRK IT workers have been involved in numerous protocols and projects for at least seven years, underscoring a persistent presence across the sector. The integration of AI tools into these campaigns compounds the risk, enabling more convincing impersonations and streamlined social-engineering workflows.

Analysts from Elliptic have summarized the evolving threat in a blog post, highlighting that the DPRK group operates along two vectors of attack—one sophisticated, another more opportunistic—targeting individual developers, project contributors, and anyone with access to crypto infrastructure. The observation echoes what Zerion and others are seeing on the ground: the barrier to entry for social-engineered breaches is lower than ever, thanks to AI’s ability to automate and tailor deceptive content at scale.

As the narrative broadens, observers stress that the human factor—credentials, session tokens, private keys, and trusted relationships—continues to be the primary entry point. The shift in tactics means companies must defend not only their code and deployments but also the integrity of internal communications and access paths that connect teams to critical assets.

What readers should watch next

Given the cross-cutting nature of these attacks, market participants and builders should monitor several developing threads. First, the Drift Protocol episode and Zerion’s incident together illustrate that DPRK-affiliated actors are pursuing a multi-stage, long-term approach that blends traditional social engineering with AI-augmented content creation. This implies that short-term fixes—such as patching a single vulnerability or alerting on suspicious code—will be insufficient without strengthened identity and access controls across the entire organization.

Advertisement

Second, the expansion of AI-enabled deception into ordinary collaboration channels suggests that defenders should heighten monitoring for anomalous login sessions, unusual privilege escalations, and suspicious impersonations within internal messaging and meeting platforms. As SEAL and Mandiant have shown, attackers leverage pre-existing trust relationships to lower suspicion, making human-level vigilance essential alongside technical controls.

Finally, the broader ecosystem should anticipate continued public reporting and analysis from researchers as more incidents surface. The convergence of AI with social engineering raises questions about regulatory and industry standards for incident response, vendor risk management, and user education. As the industry absorbs these lessons, it will be critical to track how wallets, protocols, and security firms adapt to an attacker playbook that increasingly emphasizes the human element paired with AI tooling.

For ongoing context, readers can review the Drift Protocol exploit analysis tied to the same DPRK-linked activity, the SEAL advisory tracking UNC1069, and Mandiant’s assessment of the group’s techniques, including AI-assisted deception. Commentary from researchers who have studied DPRK actors—such as Taylor Monahan and Elliptic—helps illuminate the depth and persistence of the threat, underscoring that the threat landscape is not only about exposed smart contracts but about how teams defend their people as well as their code.

As this area evolves, developments to watch include new case updates from Zerion and Drift Protocol, any shifts in threat actor tooling, and regulatory responses aimed at improving transparency and resilience in crypto businesses. The key throughline remains clear: the strongest defense combines robust identity hygiene with a vigilant, AI-informed security posture that can detect and deter sophisticated social-engineering campaigns before they strike.

Advertisement

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

AAVE rises 4.3% as trades flat

Published

on

9am CoinDesk 20 Update for 2026-04-15: vertical

CoinDesk Indices presents its daily market update, highlighting the performance of leaders and laggards in the CoinDesk 20 Index.

The CoinDesk 20 is currently trading at 2058.34, up 0.4% (+9.17) since 4 p.m. ET on Tuesday.

Eighteen of 20 assets are trading higher.

9am CoinDesk 20 Update for 2026-04-15: vertical

Leaders: AAVE (+4.3%) and APT (+3.8%).

Laggards: CRO (-0.6%) and SOL (-0.5%).

Advertisement

The CoinDesk 20 is a broad-based index traded on multiple platforms in several regions globally.

Source link

Continue Reading

Crypto World

eToro (ETOR) Stock Gains Ground Following $70M Zengo Crypto Wallet Acquisition

Published

on

ETOR Stock Card

Key Highlights

  • Trading platform eToro has entered an agreement to purchase crypto wallet company Zengo for approximately $70 million
  • Zengo leverages multi-party computation (MPC) security, eliminating seed phrase requirements
  • The acquisition is designed to integrate self-custody features and decentralized trading capabilities into eToro’s ecosystem
  • ETOR shares have declined more than 1% so far this year and approximately 48% over the trailing twelve months
  • Citizens analyst Devin Ryan reduced his target price to $85 while maintaining a bullish outlook with ~145% potential upside

eToro (ETOR) revealed on Wednesday that it has reached an agreement to purchase Zengo, a crypto wallet service provider, in a transaction valued at approximately $70 million according to industry reports. The company’s shares experienced a modest uptick following the announcement.

Established in 2018, Zengo has amassed over 2 million users worldwide. The platform provides a non-custodial wallet solution, empowering users to maintain direct control over their digital assets without intermediary involvement.

Zengo’s architecture employs multi-party computation (MPC) technology for asset security, eliminating the traditional seed phrase requirement. This approach addresses a persistent challenge in self-custody solutions: the vulnerability associated with lost or compromised recovery keys.


ETOR Stock Card
eToro Group Ltd., ETOR

The acquisition brings established functionality including token swapping capabilities, staking services, and fiat currency onramps that Zengo currently provides. The wallet infrastructure will operate independently from eToro’s regulated offerings, enabling users to engage directly with third-party decentralized protocols.

Speaking on the strategic timing, eToro CEO and co-founder Yoni Assia stated, “As we often say, crypto downtimes are the time to build and this acquisition reflects that long-term approach.”

According to company statements, the purchase will enable eToro to better serve emerging cryptocurrency applications — particularly tokenized real-world assets, decentralized prediction markets, and perpetual futures contracts. The platform intends to weave Zengo’s underlying technology into its core infrastructure moving forward.

Advertisement

“[The acquisition] will strengthen our ability to support evolving digital asset use cases, including tokenized assets and emerging decentralized trading models,” eToro announced in an official statement.

The Zengo deal follows closely on the heels of eToro’s launch of its proprietary app marketplace, unveiled just one day earlier. This marketplace provides a centralized hub for investors and third-party developers to create and access trading tools, analytics platforms, and other functionality within eToro’s environment. ETOR shares jumped more than 4% following that app store reveal.

ETOR Stock Faces Headwinds Despite Strategic Moves

Notwithstanding recent strategic initiatives, the stock has struggled significantly. ETOR has shed over 1% since the beginning of the year and tumbled roughly 48% over the past twelve-month period.

Last week, Devin Ryan from Citizens adjusted his price target downward to $85 from a higher previous level, though this still represents approximately 145% appreciation potential from current trading levels. Ryan noted that “navigating volatility remains the central challenge” facing capital markets and fintech businesses, adding that cryptocurrency market sentiment “remains impaired” in the near term.

These headwinds were evident in eToro’s fourth-quarter financial performance. Revenue from digital assets plummeted 38% during the quarter that concluded on December 31. However, the company still managed to generate a quarterly profit of $69 million, representing approximately 16% growth compared to the same period a year earlier.

Advertisement

Analyst Sentiment and Price Projections

Among Wall Street analysts, the consensus rating for ETOR stands at Moderate Buy, reflecting seven Buy recommendations and three Hold ratings issued over the last three months.

The average analyst price target currently sits at $52.80, suggesting roughly 52% upside potential from present price levels.

The Zengo transaction remains subject to standard closing requirements and regulatory conditions. While eToro has not publicly verified the $70 million purchase price, Bloomberg reported the figure based on information from a source familiar with the transaction terms.

Advertisement

Source link

Continue Reading

Crypto World

WULF lower by 6% after $900 million capital raise

Published

on

WULF lower by 6% after $900 million capital raise

TeraWulf (WULF), a US data center operator focused on bitcoin mining and AI computing, saw its shares drop early Wednesday, after the company announced a $900 million capital raise.

The firm priced 47.4 million shares at $19 each. WULF is down 5.8% to $19.73 in early trading. The underwriter greenshoe option is for an additional 7 million shares.

Alongside other AI infrastructure names, WULF has been on a scorching run, rising more than 50% since late March.

The proceeds are earmarked for funding the construction of a major data center campus in Hawesville, Kentucky, alongside repaying outstanding bridge financing and supporting future expansion.

Advertisement

Preliminary Q1 results

Alongside the offering, TeraWulf released preliminary first-quarter 2026 results. The company expects revenue between $30 million and $35 million. The balance sheet showed $3.1 billion in cash and $5.8 billion in total debt.

Management highlighted a growing shift toward contracted HPC hosting revenues, which now account for over half of total revenue, positioning the business for more stable, long-term cash flows.

Compass Point analyst Michael Donovan, who has a Buy rating and a $28 price target on WULF, pointed to the shift in mix toward HPC as a positive inflection point for the business, with contracted hosting revenue overtaking bitcoin mining for the first time. He also views the capital raise as a necessary step to unlock the next phase of growth. While acknowledging the dilution, he said the added funding improves visibility into the buildout of the Kentucky site, which he expects to be developed in phases based on customer demand. He added that demand for TeraWulf’s power and hosting capacity remains strong.

Looking ahead, Donovan expects the company’s revenue profile to change meaningfully as HPC scales. He forecasts that contracted hosting will become the dominant driver of revenue over the next two years, reducing reliance on bitcoin price swings and supporting a more predictable earnings stream.

Advertisement

The shift reflects a broader trend across the industry, as bitcoin miners increasingly pivot toward AI and high-performance computing infrastructure to diversify revenue streams and improve margins.

Source link

Continue Reading

Crypto World

EU Adviser Says MiCA 2 Likely as Crypto Market Matures

Published

on

Europe, European Union, MiCA, Paris Blockchain Week

A European Commission adviser said the European Union’s landmark MiCA crypto regime is likely to evolve as digital asset markets develop beyond the conditions the law was originally designed to address.

Speaking at the Paris Blockchain Week (PBW) 2026, Peter Kerstens, an adviser on technological innovation, digital transformation and cybersecurity at the European Commission’s financial services department, said the Commission will review the Markets in Crypto-Assets Regulation (MiCA) and launch a public consultation to assess whether the rules are working for market participants and supporting business development.

The remarks suggest EU policymakers are already thinking about how MiCA may need to evolve as the crypto market matures. Kerstens said he could not predict the future, but added that EU financial legislation typically evolves in stages, suggesting it would be “rather unusual” if there were not a “MiCA 2” over time.

MiCA already contains a built-in review clause. The regulation requires the Commission to report on its application by June 30, 2027, and allows it to accompany that review with legislative proposals if needed, according to the Official Journal of the European Union.

Advertisement
Europe, European Union, MiCA, Paris Blockchain Week
OKX global managing partner Haider Rafique (left) with Peter Kerstens (right) at the PBW 2026. Source: Cointelegraph

MiCA review signals next phase of EU crypto rules

Kerstens said the review is not a response to a broken framework, but part of an effort to ensure rules keep pace with a changing market structure. He said MiCA was designed at a time when crypto markets were dominated by a few large assets and many smaller tokens. 

He said that the ecosystem has since matured, requiring policymakers to reassess whether the framework fits in current conditions. 

Related: EU central bank backs plan for crypto supervision under EU markets watchdog

He also emphasized the role of industry feedback, saying that the Commission would begin with a public consultation with “no taboos.” Kerstens invited market participants to identify where rules should be expanded, adjusted or left unchanged. 

He warned that if regulation does not evolve alongside innovation, markets may develop around existing rules, creating legal uncertainty.  

Advertisement

Kerstens’ comments come as aspects of MiCA and related frameworks are being tested in practice. On March 24, stablecoin issuer Circle urged the European Commission to adjust parts of its proposed Market Integration Package, including lowering thresholds that limit the use of euro-denominated stablecoins in settlement and expanding access for crypto-asset service providers. 

At the same time, policymakers are debating how MiCA should be implemented. On April 3, officials weighed whether to shift supervision of major crypto firms to the European Securities and Markets Authority (ESMA) amid concerns over inconsistent enforcement

Magazine: Singapore isn’t a ‘crypto hub’ — it’s something better: StraitsX CEO

Advertisement