Researchers Link CryptoCore Attacks On Cryptocurrency Exchanges to North Korea State-sponsored hackers affiliated with North Korea have been behind a slew of attacks on cryptocurrency exchanges over the past three years, new evidence has revealed. Attributing the attack with "medium-high" likelihood to the Lazarus Group (aka APT38 or Hidden Cobra), researchers from Israeli cybersecurity firm ClearSky said the campaign, dubbed " CryptoCore," targeted crypto exchanges in Israel, Japan, Europe, and the U.S., resulting in the theft of millions of dollars worth of virtual currencies. The findings are a consequence of piecing together artifacts from a series of isolated but similar reports detailed by F-Secure, Japanese CERT JPCERT/CC, and NTT Security over the past few months.