Suspected North Korean Hackers Breach Crypto Cloud Systems

Security researchers at Ctrl Alt Intel say a threat group believed to be linked to North Korea carried out coordinated attacks against crypto companies by exploiting the React2Shell flaw and stealing AWS credentials to access cloud systems. The hackers reportedly stole private keys, configuration data, source code, and Docker images tied to staking platforms and exchange providers such as ChainUp, using infrastructure traced to a South Korea-based server, though attribution remains moderate and the source of the compromised credentials is still unknown.