North Korea's UNC4899 Breached Crypto Firm via AirDropped

North Korean APT Turns AirDrop Into a Weapon Against Crypto Firms

North Korean state-sponsored threat actor UNC4899 — also tracked as Jade Sleet, PUKCHONG, Slow Pisces, and TraderTraitor — successfully breached a cryptocurrency organization by tricking a developer into AirDropping a trojanized archive from their personal device to a corporate work machine. The attack, which occurred during 2025 but was detailed in research published March 9, 2026, enabled the group to steal millions of dollars in cryptocurrency through a sophisticated cloud compromise chain.

Incident Details

How the Attack Unfolded

Phase 1 — Social Engineering via AirDrop

A developer at the target organization was deceived into accepting a file transfer via Apple AirDrop from a personal device to their corporate work machine. The file appeared to be a legitimate developer tool — specifically a fake Kubernetes CLI — matching the kinds of developer-focused lures the group has favored in prior campaigns.

Phase 2 — Backdoor Installation

Once executed, the trojanized archive deployed a persistent backdoor on the compromised workstation. Rather than using loud, detectable malware, UNC4899 employed a living-off-the-cloud (LotC) approach — abusing legitimate cloud-native tools and APIs to blend in with normal developer activity.

Phase 3 — Google Cloud Pivot

The backdoor enabled the attackers to pivot directly into the victim's Google Cloud environment. From there, the threat actors:

• Exposed CI/CD pipeline tokens stored within the cloud environment
• Enumerated cloud resources to identify cryptocurrency wallets and key management services
• Modified Kubernetes deployment configurations to establish persistence — injecting a bash command into pod startup sequences so a backdoor was re-downloaded every time a new pod was created

Phase 4 — Account Takeover and Theft

With cloud access secured and persistence established, UNC4899 reset accounts and exfiltrated or transferred millions of dollars in cryptocurrency.

Impact Assessment

Recommendations

For Security and IT Teams

Implement context-aware access controls and enforce phishing-resistant MFA on all cloud management interfaces. Ensure only trusted, verified container images are deployed in Kubernetes environments, and isolate compromised nodes immediately if suspicious activity is detected.

For Developers and Employees

• Never transfer files from personal devices to corporate machines via AirDrop, Bluetooth, or other peer-to-peer channels
• Verify the source of any developer tool before executing it on a corporate device
• Report unsolicited file-sharing requests to your security team

Organizational Controls

• Disable AirDrop and Bluetooth file transfer on corporate macOS devices via MDM policy
• Implement strict secrets management — rotate all CI/CD tokens and cloud credentials regularly
• Monitor Kubernetes pod configurations for unexpected changes to startup commands
• Log and alert on unusual cloud API calls, especially around IAM and key management services
• Restrict cloud credential scope — apply least privilege to all service accounts and pipeline tokens

Key Takeaways

1. UNC4899 (TraderTraitor) remains one of the most sophisticated cryptocurrency-targeting threat actors globally, responsible for billions in cumulative theft.
2. The use of AirDrop as an infection vector represents a novel physical-social engineering technique that bypasses email and web-based security controls.
3. Living-off-the-cloud (LotC) tactics make detection difficult — attackers abuse legitimate cloud APIs rather than deploying noisy malware.
4. Kubernetes persistence via modified deployment configs is increasingly common in cloud-native attacks.
5. The breach highlights the risk of developer personal-device contamination — a single compromised personal device can bridge into highly privileged cloud environments.
6. Organizations holding cryptocurrency must treat their developer workstations and CI/CD pipelines as critical attack surfaces.

Sources

• The Hacker News — UNC4899 Breached Crypto Firm After Developer AirDropped Trojanized File
• Crypto Times — North Korea-Linked Hackers Target Crypto Supply Chain in Cloud Breach
• InfoSec Today — UNC4899 Breached Crypto Firm After Developer AirDropped Trojanized File