Ripple is now sharing its internal threat intelligence on North Korean hackers with the crypto industry, the company said Monday, in a move that reframes how the sector is responding to a shift in DPRK attack methodology.

The Drift hack was not a hack in the way most people think of one.

Nobody found a bug or exploited a smart contract. North Korean operatives spent months befriending Drift’s contributors, slipped malware onto their machines, and walked off with the keys. By the time the $285 million moved, every system that was supposed to catch a hack had nothing to flag.

That is the version of events Ripple and Crypto ISAC, the crypto industry’s threat-sharing group, laid out Monday alongside news that Ripple is now sharing its internal…