Behind the $1.4 Billion Crypto Theft: Hacker Developer’s Computer “Packet Sniffed,” Internal Operation Details Revealed for the First Time

[Crypto World] Cybersecurity company Hudson Rock recently did something quite interesting—they stumbled upon some big news while analyzing a malware log.

Here’s what happened: While reviewing records from the LummaC2 info-stealer program, researchers noticed something unusual about one infected computer. The owner of this device? Most likely a programmer who writes malicious code for North Korea’s official hacker organization. Even more shocking, this very machine was used to set up the attack infrastructure behind the $1.4 billion theft from a major exchange earlier this February.

Digging deeper, they found that the login credentials stored on this computer matched those used to register fake exchange domains before the attack. The hardware setup showed no expense spared—it had professional development tools like Visual Studio and Enigma Protector, plus a stack of communication apps including Astrill VPN, Slack, and Telegram.

Browsing history revealed that the attacker specifically bought domains for phishing and prepared fake Zoom installers as bait. This exposure offers a rare glimpse into how these state-level hacker teams share resources and coordinate their operations. It’s now almost certain that the massive theft was orchestrated by a highly organized professional team.