Security researchers say a hacking campaign targeting cryptocurrency companies used React2Shell flaws and stolen AWS access tokens to break into staking services, exchange software providers, and crypto exchanges. The operation may be linked to North Korean state-backed actors, though investigators described the attribution as only moderate confidence.
Once inside, the attackers focused on source code, cloud secrets, and internal configurations. That access could support later thefts of digital assets. Investigators also found private keys and wallet details in exposed configuration files, showing that compromised systems may have put funds at risk.
Automated scanning exposed backend code and wallet credentials
The researchers found that the attackers scanned thousands of internet-facing targets that appeared vulnerable to React2Shell, using automated scripts built to evade security filters. In one case, the campaign exposed the backend source code of a USDT staking platform. Environment variables on the breached system contained sensitive wallet credentials, including TRON wallet addresses and private keys.
Analysts later observed a transfer of 52.6 TRX shortly after the exposure. They could not verify that the same threat actors made that transaction. The compromised server also contained malware from unrelated intruders, including XMRig mining tools and remote administration software, which suggests the same weakness was being exploited by multiple criminal groups at the same time.
Stolen AWS credentials enabled broad cloud reconnaissance
In a separate intrusion involving another crypto organization, the attackers used valid AWS tokens to confirm access and begin mapping the full cloud environment. They enumerated S3 buckets, RDS databases, EC2 instances, and Lambda functions, then searched storage for configuration files, credentials, and encryption keys.
Investigators said the attackers paid particular attention to Terraform state files because those files often expose infrastructure secrets. From there, they obtained database credentials and internal system details. They also used AWS permissions to move into Kubernetes clusters running on Amazon EKS, enumerate active pods, extract container settings, and download Docker images that held exchange software and internal credentials.
Secrets Manager, Kubernetes, and private Git repositories were all targeted
The report says the attackers aggressively collected secrets from AWS Secrets Manager and Kubernetes environments. They retrieved plaintext credentials and decoded base64 secrets from cluster configurations. They also accessed configuration files stored inside running containers, widening the amount of usable information they could gather.
Researchers found that the attackers cloned private Git repositories hosting internal exchange applications. Some of the stolen software was tied to applications developed by crypto infrastructure provider ChainUp. Analysts believe the victim was more likely a ChainUp customer than the vendor itself. The investigation also found that the attackers extracted five container images containing proprietary exchange logic, hardcoded credentials, and internal service configurations.
South Korean infrastructure and familiar tradecraft shaped attribution
Investigators traced the attack infrastructure to servers hosted in South Korea. The main attack server used IP address 64.176.226[.]36 and the domain itemnania[.]com. The operators also accessed systems through South Korean FlyVPN nodes in an effort to hide their origin.
The command-and-control activity involved VShell and FRP tunneling tools. VShell was observed on port 8082, while FRP maintained persistent access over port 53. Researchers said the methods resemble earlier North Korean operations against the crypto supply chain, especially tactics associated with TraderTraitor, but added that direct evidence remains limited.