The cybersecurity landscape for cryptocurrency companies took a sharp turn on April 4, 2023, when researchers revealed that the massive 3CX supply chain attack was specifically designed to target digital asset firms. What initially appeared to be a broad-based assault on enterprise communications software turned out to be a precision operation by North Korea’s Lazarus group, aimed squarely at stealing cryptocurrency funds.
The Exploit Mechanics
The attack vector was deceptively simple in concept but sophisticated in execution. Hackers compromised the development infrastructure of 3CX, a telecommunications company whose business communication products are used by over 600,000 organizations worldwide. By poisoning the 3CXDesktopApp installers for both Windows and macOS, the attackers distributed trojanized software to thousands of companies across Europe, North America, and beyond.
Once installed, the compromised application collected sensitive browser data from infected systems, including stored credentials, cookies, and session tokens. The attackers then used this initial reconnaissance to identify high-value targets—specifically, cryptocurrency companies. For these select victims, the hackers deployed a second-stage payload called Gopuram, a powerful backdoor that had only been observed a handful of times since 2020.
Kaspersky researchers noted that fewer than 10 devices received the Gopuram implant during the 3CX campaign, and the majority of those belonged to cryptocurrency firms. This selective deployment suggests the attackers were not interested in mass data collection but rather in gaining deep access to crypto exchange infrastructure and wallet systems.
Affected Systems
The compromised 3CXDesktopApp affected organizations running both Windows and macOS systems. The vulnerability was tracked as CVE-2023-29059. Initial access to 3CX’s development systems is believed to have occurred sometime in late summer or fall of 2022, giving the attackers months to prepare their supply chain compromise before detection in March 2023.
Cryptocurrency exchanges, wallet providers, and DeFi platforms were the primary targets. The Gopuram backdoor, when deployed alongside the previously documented AppleJeus malware—a tool long associated with North Korean cyber operations against cryptocurrency firms—provided attackers with persistent access to critical financial infrastructure. With Bitcoin trading around $28,168 and Ethereum at $1,871 at the time, the potential payoff for successful cryptocurrency theft was enormous.
The Mitigation Strategy
3CX responded by advising all users to uninstall the desktop application immediately and switch to the Progressive Web App (PWA) client, which was not affected by the compromise. The company engaged cybersecurity firm Mandiant to assist with the investigation, though the initial response drew criticism from the security community for being too slow.
For cryptocurrency firms specifically, the incident underscored the importance of isolating critical infrastructure from general-purpose enterprise software. Security experts recommended that organizations handling digital assets implement strict network segmentation, ensuring that systems with access to cryptocurrency wallets and exchange APIs are physically and logically separated from general employee workstations running third-party communications tools.
Lessons Learned
The 3CX attack demonstrates that supply chain compromises represent one of the most dangerous threats to cryptocurrency companies. Unlike direct attacks on blockchain protocols, supply chain attacks exploit the trust relationships between software vendors and their customers. Cryptocurrency firms are particularly attractive targets because of the irreversible nature of blockchain transactions—once funds are stolen, recovery is extremely difficult.
North Korean hackers stole between $630 million and over $1 billion in virtual assets in 2022 alone, according to United Nations experts. The 3CX campaign shows that these groups are willing to invest significant resources into long-term, sophisticated operations to maintain access to cryptocurrency targets.
User Action Required
Cryptocurrency companies and individual users should take immediate steps to protect themselves from similar supply chain attacks. Audit all third-party software installed on systems that have access to cryptocurrency wallets or exchange accounts. Implement application whitelisting to prevent unauthorized software from executing on critical systems. Enable hardware-based two-factor authentication for all exchange accounts and wallet access. Monitor network traffic for unusual outbound connections, particularly to known command-and-control infrastructure. Finally, maintain offline backups of wallet seed phrases and never store them on systems that run third-party desktop applications.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always consult with qualified cybersecurity professionals for specific threat assessments.
Lazarus compromising 3CXDesktopApp to target crypto firms specifically. 600K orgs infected and most had no idea they were the intended victims
supply_chain_rat the fact that browser cookies and session tokens were the primary payload tells you North Korea understood the crypto attack surface better than most CISOs
the fact that 3CX shipped signed installers and nobody verified the hash for weeks tells you everything about enterprise security theater. signing certificates mean nothing if nobody checks them
600k organizations running 3CXDesktopApp and nobody verified the installer hash. supply chain security is still in the dark ages
reproducible builds should be mandatory for any software touching financial systems. the fact that 3CX shipped signed installers that were trojanized and nobody verified the hash is a sector wide failure
lazarus went after 3CX because crypto firms use it for internal comms. the targeting was surgical. they knew exactly which orgs to hit
dprk_watch Lazarus knew exactly which crypto firms used 3CX. that means they had reconnaissance on the target set before the attack. the supply chain was the delivery mechanism not the reconnaissance phase
cold_storage_ exactly this. the supply chain was delivery not recon. Lazarus had mapped target wallets months before through phishing campaigns. 3CX just gave them a wider net
Lazarus targeting crypto firms through a comms app is next level. they mapped which companies used 3CX before deploying the payload
lazarus using a legit enterprise app to target crypto firms is next level. 600k orgs using 3CX and they specifically went after the crypto ones
lazarus has been the most sophisticated crypto theft operation for years. they dont brute force, they engineer social vectors through legitimate software
supply chain attacks are nearly impossible to defend against as an end user. you install trusted software and it’s already compromised. what do you even do
igor is right, you literally cant audit every dependency in your stack. reproducible builds should be the default, right now theyre optional
brennan_k_ you literally cant audit every dependency but you can at least verify hashes on critical infrastructure. most orgs dont even do that bare minimum
reproducing builds and verifying binary hashes is the only defense. if your org isnt doing that for critical software, you are flying blind
^ hardware wallets saved a lot of people here. even with stolen browser credentials, the private keys never touch a machine running 3CX if you use a ledger properly
the only real defense is minimizing what you install on machines that touch your keys. air gapped signing is annoying but supply chain attacks make it necessary
air gapping is the move but try convincing a dev team to use a separate offline machine for signing. the UX friction is real
the UX argument is real but ledger and trezor have made it easier. the actual problem is enterprise teams running hot wallets on machines with 3CX installed
Tomas the enterprise hot wallet issue is the real vulnerability. no retail user running 3CX had millions at risk but crypto companies managing treasury on machines with comms software installed is negligence at the IT level
Igor N. air gapped signing is the only real answer but nobody wants to hear it. convenience is the enemy of security in crypto
600k orgs infected and they specifically filtered for crypto companies. Lazarus understood the target graph better than most CISOs understand their own networks