How To Keep Your Crypto Safe from North Korea's 2,500 Hackers

Pablo Sabatella, who began hacking in 1989 and now runs operational security audits for crypto companies and high-net-worth individuals, argues that 99 percent of stolen crypto funds come not from smart contract exploits but from attacks on people. His co-presenter Pablo Manchel states that 99 out of 100 security incidents he investigates begin with a compromised device, typically an infected laptop, and that endpoint detection and response software such as Crowdstrike or Sentinel-1, costing roughly 150 dollars per year per device, would have stopped nine out of ten of those incidents. EDR tools detect malicious behavior including unusual memory access, unexpected IP connections, and keystroke logging rather than relying on known file signatures, making them a meaningful upgrade over traditional antivirus.

North Korea is identified as the single biggest threat actor in crypto, with approximately 2,500 people dedicated to hacking operations. DPRK uses a two-tier structure where less sophisticated actors handle initial infection and more sophisticated actors handle lateral movement and privilege escalation. They are willing to invest one million dollars of their own money to compromise a target if the expected return justifies it. Fake job interview schemes are a primary infection vector, where targets are asked to clone a repository, download files, or share their screen. More than half of people infected during these interviews do not disclose the infection, often because they were interviewing while employed elsewhere, giving attackers an undetected foothold inside company infrastructure. DPRK also runs a tech worker infiltration program where operatives pose as workers based in Western countries, sometimes holding three or four jobs simultaneously. They now use US citizens running laptop farms with TeamViewer to pass KYC checks and video interviews on behalf of North Korean operatives, and the US citizen operating the farm may not know he is working for North Korea. Pablo's personal policy is to meet every team member in person before hiring, treating an inability to travel to Europe or the US as grounds to reject a candidate.

Hot wallets store private keys on the device itself, meaning malware can steal the private key and drain funds even if the seed phrase is written on paper. The speakers observe between five and ten people losing more than one hundred thousand dollars daily through hot wallet use. Storing a seed phrase in a password manager is described as a very bad idea, with paper being the only recommended medium. Pablo described a manual Shamir-style split dividing 24 seed words across three lists so any two of the three reconstruct the full seed but no single list alone can, and suggested anti-tampering bags costing roughly ten cents each to detect unauthorized access. Buying a hardware wallet directly from the manufacturer risks exposing your home address and crypto ownership if the company's customer database is breached, as happened with Ledger and Trezor. Buying from third-party Amazon sellers risks receiving a tampered device. Fake hardware wallets appear as USB drives with executable files rather than functioning as proper signing devices, and Ledger verifies authenticity through firmware signature checks when connected to its software.

Time-based one-time password codes from Google Authenticator, Authy, and Microsoft Authenticator are not phishing resistant because an attacker can capture both the password and the 2FA code in real time through a phishing site. Storing passwords in Chrome, 2FA codes in Google Authenticator, and passkeys in Android, all synchronized to a single Google account, means one account compromise exposes all credentials. Passkeys stored in iCloud, Google accounts, or password managers lose their security properties because they are synchronized outside the secure enclave of the device. Manchel recommends storing passkeys on a hardware security key with a mandatory PIN, which makes them phishing resistant and requires both physical theft and knowledge of the PIN to compromise. Once a device is fully compromised, hardware security keys and passkeys cannot protect accounts because attackers steal active sessions directly.

Attacks are increasingly arriving from trusted sources such as a co-worker's real email account, a legitimate but hacked newsletter, or directly from Google infrastructure. Sabatella described nearly falling victim to an address poisoning attack by almost copying a fake recipient address from a block explorer that differed from the real address by only a few digits, catching it only by confirming the address directly with the recipient. Video calls can no longer be trusted as proof of identity because deepfakes are indistinguishable from real video. His operating principle is to treat everything as a scam until proven otherwise, and he argues that verifying the source of a communication is insufficient because the content itself must also be independently verified.

Pablo argued that AI changes the security equilibrium in favor of attackers because both sides have access to the same tools, and that a well-resourced attacker could allocate twenty million dollars of compute to an AI system to find vulnerabilities in any protocol. The attack-defense asymmetry means defenders must find all bugs while attackers need only one. He identified three priorities for protocol security as AI-powered vulnerability scanning with sufficient compute, formal verification, and operational security, and suggested that in one to two years AI-generated code may be significantly safer than human-written code. Manuel Araoz, an early founder of OpenZeppelin, publicly advised friends and family to exit all DeFi positions including blue chips like Aave, MakerDAO, and Compound, though one host noted Araoz left OpenZeppelin around 2019 and questioned how current his hands-on expertise is.