North Korean malware targets banks and crypto

TLDR

North Korea-linked hackers are deploying advanced malware that targets banks and crypto, combining social engineering with hard?to?detect techniques.

1. State-backed groups like Lazarus are using new fileless malware such as RemotePE to infiltrate banks and crypto firms through tailored social engineering.
2. These campaigns are a major driver of crypto losses, with North Korean actors linked to around three quarters of global hack volume in early 2026.
3. The highest-risk targets are developers, employees, and high-value users, so tightening operational security, key management, and software supply chains is now critical.

Deep Dive

1. How The New Malware Works

Cybersecurity researchers have identified RemotePE, a fileless remote-access malware attributed to North Koreas Lazarus Group that specifically targets banks and cryptocurrency companies. It runs entirely in memory, leaving almost no disk traces, which makes it extremely hard for traditional antivirus tools to detect or analyze.

Attackers typically start by impersonating staff from legitimate investment or trading firms on Telegram, then send fake meeting invites via services like Calendly and PicTime to trick victims into executing loader components that pull RemotePE from a command server, giving the attackers deep access to financial systems and crypto infrastructure.

Parallel campaigns such as TrapDoor hide malware in seemingly normal developer packages on npm, PyPI, and Rusts Crates, aiming to steal wallet keys, API tokens, SSH keys, and cloud credentials used by major services like Coinbase, Binance, MetaMask, and Brave wallet extensions. These packages can also abuse AI coding assistants by embedding malicious prompts that exfiltrate secrets under the cover of security checks.

2. Impact On Crypto And Banks

Reports attribute several recent high profile DeFi and bridge exploits, including nine figure incidents against KelpDAO and other protocols, to North Korea linked threat actors that mix social engineering with infrastructure level access.

Analytics from firms tracking illicit flows show how dominant this activity has become: by early 2026, North Korean groups were responsible for roughly 70 to 80 percent of global crypto hack losses, after stealing billions of dollars in 2025 and hundreds of millions more in the first months of 2026. Those funds are widely believed to help finance sanctioned state programs, which keeps pressure high on regulators, banks, and exchanges to respond.

Banks and fintechs are in the same blast radius, since session keys, API access, and developer credentials often bridge traditional systems and digital asset rails. That makes compromised workstations or repositories a pivot point from IT environments into wallets, custodians, and payment infrastructure.

3. Who Is Most At Risk And How To Respond

The primary targets are:

1. Developers who install dependencies or extensions without strict scrutiny.
2. Employees with access to admin panels, bridges, or treasury systems.
3. High value crypto holders who interact with traders, funds, or recruiters over Telegram, LinkedIn, or Zoom.

Effective defenses focus on operational discipline rather than just code audits. That includes keeping exchange and wallet API keys out of repositories, rotating secrets after any toolchain or SaaS breach, using hardware wallets for large balances, and treating any unsolicited job or investment outreach that leads to file downloads or meeting links as inherently suspect.

Conclusion

North Korean malware today blends stealthy, memory only implants with patient social engineering and supply chain abuse, turning developers and staff into the weak link between banks, DeFi, and bridges. For crypto users and institutions, the practical response is to harden people, keys, and tooling together, since attackers increasingly aim at the interfaces between them rather than at smart contract bugs alone.