North Korea's crypto hackers now lurk for weeks before striking

North Korea's crypto hacking crews have gone patient, according to the researcher known as tayvano_. Instead of a quick smash-and-grab, attackers burrow into compromised systems and stay there for weeks before they strike.

In comments surfaced by CoinDesk, tayvano_ described the crews as methodical rather than opportunistic. The warning centers on dwell time — the stretch of quiet access attackers hold before they move on a target's funds.

That long, silent stretch inside a system is the part of the playbook tayvano_ puts front and center. The assessment comes from a researcher who tracks these campaigns closely, and it points to operations that are planned out in advance rather than executed on impulse.