As a blockchain security guy, it's really easy to spot the occasional North Korean heists on Ethereum. The big tells are:
1. They hack computers not code. Their normal plan is to steal keys by compromising users and computers. This is in contrast to the normal "hack" that works by finding and exploiting bugs in code.
2. They immediately exfiltrate the stolen money back to the real world via bazillions of mule accounts that are already standing by. In contrast to the "normal" hacker who attempts to obfuscate and hide funds on-chain, and slip away with some at a far future date.
Here's a writeup from a company after the big 600 million dollar NK hack.
1. They hack computers not code. Their normal plan is to steal keys by compromising users and computers. This is in contrast to the normal "hack" that works by finding and exploiting bugs in code.
2. They immediately exfiltrate the stolen money back to the real world via bazillions of mule accounts that are already standing by. In contrast to the "normal" hacker who attempts to obfuscate and hide funds on-chain, and slip away with some at a far future date.
Here's a writeup from a company after the big 600 million dollar NK hack.
https://roninblockchain.substack.com/p/back-to-building-roni...