North Korean Hackers Compromised 1640 Companies Across 57 Countries, Crypto Theft Primary Target

For nearly two years, a cybersecurity researcher maintained a hidden vantage point inside the command-and-control infrastructure of North Korean state-backed hackers.

The operation, conducted by Kumio CTO Vangelis Stykas, uncovered a breach footprint that dwarfs many previous estimates: 1,640 companies across 57 countries had been compromised, with crypto theft sitting at the center of the campaign.

The scale and tactical focus revealed in the original report force a fresh reckoning with the structural weaknesses that allow such intrusions to spread.

The attackers relied on fake job interview lures, a social-engineering vector that has become a signature of North Korean cyber operations. But the damage went far deeper than phishing.