crowdstrike

According to NBC, North Korea is utilizing remote IT workers from third countries such as Iran and Lebanon to assist in infiltrating American companies and obtaining funds to finance its weapons programs. Alerts issued by the U.S. and several foreign agencies in July indicated that North Korean IT workers "seek to sign contracts with the intention of remitting salaries back to relevant North Korean agencies," while also posing internal threats to companies, involving data leaks, cryptocurrency theft, and sensitive information theft.As governments like the United States increase countermeasures, North Korea is increasingly leveraging third-country IT workers to secure job interviews, and after obtaining work contracts, the relevant positions are typically taken over by North Korean agents. Reports indicate that these foreign IT workers are scouted on LinkedIn, with some earning about $500 per month in cryptocurrency to work part-time as "interview assistants."Cointelegraph reported in May, citing data from cybersecurity company CrowdStrike, that state-affiliated North Korean hackers and threat actors caused cryptocurrency losses exceeding $2 billion in 2025, a 51% increase year-on-year. The Bank of Korea estimates that despite facing global sanctions, North Korea's GDP will still grow by 3.5% in 2025.

According to Decrypt, CrowdStrike and the U.S. Department of Justice announced on Tuesday that they have dismantled the Sality peer-to-peer botnet, which has been active since 2003.This botnet primarily hijacked cryptocurrency payments through the EggJagger malware over the past eight years, which monitored the cryptocurrency wallet addresses in victims' clipboards and replaced them with the operator's own address, causing victims to send funds to strangers.CrowdStrike estimates that the operator has stolen at least 12.1 million rubles (approximately $150,000) solely through the EggJagger payload. Most of the stolen cryptocurrency has not been spent, and CrowdStrike assesses that these unspent assets were worth about 147 million rubles (nominally around $1.35 million) at their peak in January 2025. The reason Sality has survived to this day is that it does not have a central server that can be seized; infected machines communicate directly with each other.This multinational operation involved the United States, Bulgaria, Hungary, and Romania. The U.S. Department of Justice, FBI, and Defense Criminal Investigative Service seized Sality-related domains within the United States, and police from multiple European countries also seized other domains.CrowdStrike isolated more than 15,000 infected machines to its controlled honeypot by exploiting its architectural vulnerabilities. The operator has been tracked as SALTY SPIDER, which launched a denial-of-service attack against the Russian cryptocurrency exchange AvanChange in September 2023.

According to Gate market data, CrowdStrike (CRWD.O) rose by 10%, marking the largest increase since July 14.

According to Gate market data, Crowdstrike's stock rose 9.6% in pre-market trading due to the company's upward revision of its annual revenue forecast.

According to a report by Cointelegraph, a report released by cybersecurity company CrowdStrike shows that losses from cryptocurrency assets caused by North Korean hackers and threat actors exceeded $2 billion in 2025, a 51% increase year-on-year, despite a decrease in the number of attacks. CrowdStrike stated that North Korean hackers are the largest threat organization targeting cryptocurrency users, and the stolen funds are almost certainly used to finance the regime's military programs.Attackers prioritize high-value targets, mainly focusing on Web3 projects and cryptocurrency exchanges, as stolen funds are easier to cash out and transfer anonymously. In April of this year, the Ethereum Foundation identified 100 North Korean hackers, and the Drift Protocol was infiltrated by North Korean tech workers, resulting in a loss of $280 million, with these threat actors establishing face-to-face relationships through third-party intermediaries.

ChainCatcher news, according to Jinshi reports, CrowdStrike stated that it is understanding how the issue (which caused global chaos yesterday) occurred and is conducting a thorough root cause analysis to determine how the logical flaw happened. The company stated, "We are committed to identifying any improvements in our infrastructure or workflows to strengthen our processes. As the investigation progresses, updates will be provided on the results of the root cause analysis. Currently unaffected systems will continue to operate as expected, and there will be no risk of such incidents occurring in the future." The company's CEO, George Kurtz, posted on social media that the company has prepared a technical overview regarding the incident and will continue to work with customers and partners to address this event.

ChainCatcher message, Musk tweeted that CrowdStrike has been removed from all our systems. CrowdStrike founder George Kurtz stated that Mac and Linux hosts were not affected, and this incident was not a security breach or cyber attack. The issue has been identified, isolated, and a fix has been deployed.

ChainCatcher news, according to Jinshi reports, Microsoft (MSFT.O) stated that the root cause has been fixed. Due to a recent update to the CrowdStrike Falcon sensor software, Windows 365 Cloud PCs experienced issues. Although the root cause has been resolved, residual impacts continue to affect some Microsoft 365 applications and services.Meanwhile, a spokesperson for the Nasdaq exchange stated that European markets and pre-market trading in the U.S. are operating normally, and the U.S. market is expected to open normally.

ChainCatcher message, CrowdStrike founder George Kurtz posted on the X platform that CrowdStrike is actively working with customers affected by the Windows host content update defect. Mac and Linux hosts are not affected, this incident is not a security incident or cyber attack, the issue has been identified, isolated, and a fix has been deployed. CrowdStrike advises customers to visit the support portal for the latest information and to communicate with CrowdStrike representatives through official channels. The company team has been fully mobilized to ensure the safety and stability of customers.

ChainCatcher news, Polygon's Chief Information Security Officer Mudit Gupta tweeted that a significant portion of global IT infrastructure is currently paralyzed, including emergency services, airports, and stock exchanges. The issue stems from a vulnerability in the latest version of Crowdstrike Falcon EDR, causing Windows devices to crash and reboot continuously. Polygon Labs also uses Crowdstrike but was not affected because they conduct testing before deploying non-critical updates. Mudit Gupta expressed confusion that other companies supporting critical operations did not take similar precautions.Additionally, he emphasized that even if Polygon Labs were affected by this IT incident, the Polygon network would remain unaffected because its network is decentralized.