THORChain Co-Founder Loses $1.35 million to DPRK-Linked Telegram Phishing Scam

The crypto world just got a stark reminder that even industry veterans can fall victim to sophisticated attacks. JP, co-founder of THORChain, recently lost $1.35 million in a highly targeted Telegram phishing scheme believed to be linked to North Korea.

This wasn’t a simple trick; it was a multi-faceted assault involving a compromised friend’s Telegram account, a deepfake video used during a Zoom call, and what JP suspects was a zero-day exploit.

This exploit allegedly allowed attackers to steal keys from his encrypted iCloud Keychain or a Chrome profile without any overt prompts, directly draining an old MetaMask wallet he had forgotten about. Blockchain investigator ZachXBT confirmed the breach, adding a layer of irony by noting THORChain’s past associations with North Korea’s Lazarus Group.

This incident is part of a growing trend of crypto heists, with billions lost to wallet breaches and scams annually. Telegram-based malware scams, in particular, have surged by 2,000% since November, becoming a primary vector for stealing private keys and wallet data. The United Nations estimates these scams generate over $36.5 billion annually, often facilitating money laundering and illicit activities.

In the wake of his loss, JP is urging crypto users to take immediate action to bolster their security. His advice includes never backing up private keys on cloud services like iCloud or Google Drive, using two-factor authentication on a separate, dedicated device, and considering advanced threshold signature wallets like Vultisig, which distribute key shares across multiple devices for enhanced protection. “Attacks are only going to get worse,” JP warned, emphasizing the critical need for users to upgrade their wallet security to combat these escalating threats.

Image Credit: Pixabay