17 of 61 incidents this week involved compromised seed phrases or private keys. Root causes typically include: a compromised device, re-typing the seed into a fake wallet app, or exposing the seed to third-party storage. The largest loss - $5.4M: a seed kept in cloud storage.

#DPRK intrusions this week: Contagious Interview - $1.9M IT worker hired onto the team - $500k SINT-01 (Konni) - $480k All three successful intrusions happened months before the theft occurred. DPRK actors persisted on developers' devices and infrastructure for an extended period. In the case of the DPRK IT worker, an insider leveraged his access to critical infrastructure and withdrew funds to his wallet.. #UNC1069 - a single incident with $0 loss IOCs: texmslives[.]com tezmlives[.]com tevmslives[.]com microteamscall[.]com usonliues[.]us 365lineup[.]com

This week's outlier involves fake wallet apps distributing Android APKs targeting Chinese users. In one case we tracked, the user lost ~$1M. tronlinkwallet[.]cn trustwallet-web3[.]cn ledgerwallet-app[.]cn imtoken-web3[.]cn tokenpocket-web3[.]com[.]cn binancewallet[.]com[.]cn

Misc fake meeting campaigns that could not be attributed. gogglemeets[.]com us04-web-zoom[.]us workspace-zoommeeting[.]us meetinglinvite[.]com zoom[.]com[.]im