Start now →

North Korean hackers target financial firms with macOS malware using AppleScript

By Estefano Gomez · Published April 23, 2026 · 2 min read · Source: Crypto Briefing
Security

North Korean hackers have launched macOS malware attacks on financial organizations using AppleScript and ClickFix techniques. The odds of another crypto hack over $100 million by December 31 sit at 100% YES.

## Market reaction

The DPRK’s cyber operations, linked to the Reconnaissance General Bureau, have previously resulted in over $3 billion in cryptocurrency theft. With this latest vector targeting macOS, the market for another $100 million-plus crypto hack holds at its ceiling. Traders are pricing in no realistic scenario where large-scale attacks stop before year-end.

## Why it matters

The shift to AppleScript and ClickFix represents a change in tooling, not just targeting. While the odds remain at 100%, the technique change points to either broader targeting or an effort to bypass macOS-specific defenses that financial and crypto organizations rely on. DeFi protocols and crypto firms running macOS environments face direct exposure to these new methods.

Liquidity in this market is effectively zero, with combined 24-hour face value at $0. The 100% odds reflect strong trader conviction based on the historical pattern of DPRK cyber theft, but the empty order book means any new volume could move prices disproportionately. In practice, traders appear to have already positioned and are not actively trading.

## What to watch

At 100% YES, there is no payout upside for buyers. Contrarian bets only make sense if specific new security measures or geopolitical shifts (such as diplomatic agreements restricting DPRK cyber units) materially reduce hack probability before the December 31 resolution date. Neither appears imminent.

Watch blockchain security firms like CertiK and Chainalysis for alerts on new exploit patterns tied to these macOS techniques. On-chain investigator ZachXBT’s attributions have historically moved trader sentiment in hack-related markets, making his reports a useful signal.

Get prediction market intelligence as a structured API feed. Early access waitlist.

Related to This Story SEC ends crypto enforcement approach, XRP legal outlook improves
This article was originally published on Crypto Briefing and is republished here under RSS syndication for informational purposes. All rights and intellectual property remain with the original author. If you are the author and wish to have this article removed, please contact us at [email protected].

NexaPay — Accept Card Payments, Receive Crypto

No KYC · Instant Settlement · Visa, Mastercard, Apple Pay, Google Pay

Get Started →