North Korean crypto hackers recently scammed ThorChain co-founder and stole $1.3 million in cryptocurrency.
By Parth Dubey
Editor Hamza Tariq
Updated
2 mins read
THORChain co-founder JP was scammed out of around $1.3 million in cryptocurrency by North Korean hackers using a conference call scam on Telegram.
This new crypto attack comes amid the growing threat posed by AI-assisted fraud in the crypto industry.
JP(@jpthor), the co-founder of THORChain and Vultisig, was scammed out of ~$1.3M by North Korean hackers in a conference call scam.
Ironically, according to @zachxbt, JP and his products have benefited from helping the North Korean hackers launder funds.https://t.co/5LhhHCl9EC pic.twitter.com/EKicttwa6L
— Lookonchain (@lookonchain) September 12, 2025
JP, a prominent figure in the crypto space and co-founder of both THORChain and Vultisig, disclosed that the attack targeted his forgotten Metamask wallet. The wallet was still staking assets linked to his account but no longer actively used.
Hackers accessed his encrypted iCloud and keychain, ultimately draining around $1.3 million in assets. Attackers exploited a hacked Telegram account and used a deepfake video call to trick JP into merging his call.
This allowed them to access sensitive information without needing to install malware or enter passwords.
Interestingly, ZachXBT claims that JP and his products have previously benefited from crypto money laundering linked to North Korean hacks like Bybit.
The wallet likely belongs to @jpthor who had a private wallet compromised due to a fake meeting scam a few days ago.
JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks/exploits.
So it’s a bit poetic he got rekt here by DPRK. pic.twitter.com/T57RRJ0bbf
— ZachXBT (@zachxbt) September 12, 2025
In a statement shared on X, the co-founder confirmed that only the private keys stored in his Metamask wallet were affected. His Vultisig wallets, protected by multi-signature technology, remained untouched.
Yes, an old metamask (which I had completely forgotten about) was drained. They had access to my encrypted entire iCloud + keychain.
Ironically – only the private keys (radioactive) were vulnerable. Vultisig wallets were untouched, despite also using iCloud.
They're safe -… pic.twitter.com/TWw7AdCgPw
— JP (@jpthor) September 12, 2025
JP explained that one compromised key share wasn’t enough to access funds in Vultisig wallets, as additional keys were securely stored elsewhere.
The scam JP fell victim to suggests increasing smartness and crypto scam methods advancements by hackers.
Conference call scams, where attackers merge calls to access sensitive data, have become a popular way to deceive users.
AI deepfake videos and voice cloning have further made it easier for attackers to impersonate friends, colleagues, or trusted service providers.
Between May 2024 and April 2025, reports indicate that AI-driven crypto scams surged by 456%. Fake job offers, fraudulent Zoom links, and deepfake impersonations have all been used to trick victims.
JP’s case suggests that even high-profile crypto figures are not immune to threats these days.
In July, MoonPay reported that its CEO, Ivan Soto-Wright, and CFO, Mouna Ammari Siala, were tricked into sending $250,000 in cryptocurrency to a fraudster pretending to be Steve Witkoff, a co-chair of the Trump inauguration.
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to deliver accurate and timely information but should not be taken as financial or investment advice. Since market conditions can change rapidly, we encourage you to verify information on your own and consult with a professional before making any decisions based on this content.
A crypto journalist with over 5 years of experience in the industry, Parth has worked with major media outlets in the crypto and finance world, gathering experience and expertise in the space after surviving bear and bull markets over the years. Parth is also an author of 4 self-published books.
