North Korean developers hijacked dormant Waves repositories, injecting code to steal credentials in wallet updates.

Gate News bot message, according to a report by Ketman on June 18, a North Korean developer gained higher privileges in the Waves Protocol’s Keeper-Wallet codebase.

The report focused on a routine scan of North Korean activity on GitHub and found that the account ‘AhegaoXXX’ was pushing updates to Keeper-Wallet.

The wallet’s repository didn’t show any legitimate commits after August 2023, but from May 2025 they received multiple dependency boosts.

Repository analysis indicates that users can open branches, create versions, and publish to the Node Package Manager (NPM) registry, thereby giving operators full control over the organization.

The report then linked “AhegaoXXX” to a North Korean IT worker contracting gang that had previously used freelance channels to infiltrate software projects.

The scope of responsibilities for this account has exceeded simple maintenance. The redirect rules within the main Waves protocol namespace now point to the same package within the newly enabled Keeper-Wallet namespace, indicating that insiders have moved the code from the core organization to the wallet project.