Behind the $1.4 Billion Theft: The North Korean Hackers' Operation Computer Has Been "Unboxed"

[Chain News] Cybersecurity company Hudson Rock recently uncovered a major scoop—while analyzing logs from the LummaC2 trojan, they unexpectedly caught a “special” device.

The owner of this machine is suspected to be a technical backbone of a North Korean state-sponsored hacker team. Even more explosively, it was used to set up the attack infrastructure for a $1.4 billion theft at a leading exchange in February this year.

The credentials found on the device directly point to phishing domains registered before the attack, specifically designed to impersonate the target platform. The setup was hardcore: development tools like Visual Studio and Enigma Protector were all present, along with communication software such as Astrill VPN, Slack, and Telegram.

What’s even more impressive, investigators found evidence of the attacker’s preparations in the browsing history—purchasing domains, packaging fake Zoom installers, and meticulously preparing the entire phishing process.

This exposure is a rare glimpse into the internal operations of North Korean hacker organizations: they reuse infrastructure across different missions, with clear division of labor and high-level coordination. For the crypto industry, the exposure of such state-level APT attack details is, in a way, a valuable “reverse case study.”