Bitmex discovers cybersecurity errors in North Korean hacker group

The security team at Bitmex crypto exchange discovered the operational security gap in the Lazarus Group, a government-sponsored cybercrime network sponsored by the North Korean government, and has since conducted an anti-operation investigation into the organization, which exposed the IP address, database, and is an algorithm used by the malicious group.

The security researchers at the exchange said at least one hacker accidentally revealed his real IP address, indicating that the hacker’s actual location is the actual location of China’s Jiax.

Additionally, BITMEX researchers say they are able to access instances of Supabase databases, a platform for easy deployment of databases that use simple interfaces used by hacker groups.

According to the report, the analysis highlights the asymmetry between the organization’s low-skilled social engineering teams, aiming to incorporate unsuspecting victim channels into downloading malware and interacting with complex code vulnerabilities developed by high-tech hackers.

The Bitmex team said the asymmetric signal indicates that hacker groups in North Korea were split into separate subgroups, while different levels of threat capability could work with fraudulent users.

The report is a series of high-profile hacking incidents, social engineering scams, and blockchain and technology companies penetration attributed to Lazarus Group and other North Korean-related agents.

Related: North Korean spy slips and reveals connection in fake job interview

Federal law enforcement agencies and government alert Lazarus Group

Federal law enforcement agencies and governments are increasingly exploring North Korea-related hacking activities around the world, alerting many of the common scam strategies these threat actors have adopted.

In September 2024, the FBI issued a warning about social engineering scams committed by North Korean support groups, including phishing attempts to provide fake job opportunities for cryptocurrency users.

https://www.youtube.com/watch?v=ndv0rfehetq

The Japanese, U.S. and South Korean governments responded to FBI warnings in January 2025 and described hacking activities as a threat to the financial system.

Bloomberg’s latest report suggests that world leaders may discuss the threat from the Lazarus hacker group at the next G7 summit and adopt strategies to mitigate the damage caused by the North Korean trade group.

Magazine: Lazarus Group’s favorite exploit reveals – Crypto Hacker Analysis