North Korean Hackers Target Bitcoin Professionals on Telegram

North Korean hackers have been targeting Bitcoin and cryptocurrency professionals through an active social-engineering campaign on Telegram. The attack involves hijacking trusted Telegram accounts, using them to invite targets to fake video meetings on Zoom or Microsoft Teams.

JUMPSEC researchers discovered a phishing kit that profiles cryptocurrency wallets before delivering malware to selected targets. Security Alliance attributed 164 blocked domains to UNC1069 between February and early April 2026 alone. Mandiant observed compromised Telegram accounts, fake Zoom calls, ClickFix commands, and malware targeting crypto organizations.

The FBI recommends independent identity verification and keeping wallet secrets off internet-connected devices whenever possible. Researchers say the campaign remains broad, with multiple entry points and mechanisms for initial takeover, although not every claim has been verified.