iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
JumpCloud confirmed that a North Korean state-linked actor compromised an employee’s device and used access to the company’s systems to inject commands targeting a small number of customer devices. The company said the incident affected fewer than five customers and fewer than 10 devices. It did not name those customers or report a confirmed cryptocurrency theft amount, so the public record does not establish which crypto companies were hit or whether any funds were stolen.
What happened in the JumpCloud breach?
The incident was a supply-chain intrusion: attackers entered JumpCloud’s internal environment and then abused its trusted device-management commands to reach selected customer devices. In an update published September 20, 2023, JumpCloud CISO Bob Phan said the company and its incident-response partner CrowdStrike identified the actor as North Korea. JumpCloud said the attack vector was “data injection into our commands framework.” (JumpCloud’s incident disclosure)
Incident timeline
- June 20, 2023: JumpCloud said an attacker spear-phished a software engineer. Malicious code downloaded to the engineer’s company device gave the actor developer-level access to JumpCloud environments.
- June 22: The actor used that access to pivot to other systems and launch workloads for later execution in JumpCloud’s container orchestration system.
- June 23: JumpCloud security tools alerted to anomalous activity. The company revoked access and rotated known affected credentials.
- June 27: JumpCloud observed a workload activate in its orchestration system. It said it had no evidence of customer impact at that point, then began containment, infrastructure rebuilding, credential rotation, a deployment freeze, and incident-response work.
- July 4: JumpCloud said it had identified and rebuilt the last affected system and saw no further indicators on its systems after that date.
- July 5: The company found database injection dating to June 27. The injected commands instructed selected devices to download malware. After finding evidence of customer impact, JumpCloud force-rotated all customer API keys and notified the affected organizations.
JumpCloud’s incident timeline and September 2023 attribution and impact update describe this sequence.
Did North Korean hackers target crypto companies through JumpCloud?
JumpCloud attributed the intrusion to a North Korean nation-state actor and said the injected commands reached fewer than five customer organizations and fewer than 10 devices. The company did not publicly identify those customers. The disclosures therefore support saying that crypto companies were among the intended or affected targets only to the extent stated in the incident’s public framing; they do not establish the identity of a particular crypto company or confirm that cryptocurrency was stolen.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
The broader threat is real, but it should not be conflated with proof about this specific breach. In a September 3, 2024 advisory, the FBI said North Korean actors conduct tailored social-engineering campaigns against employees of decentralized-finance, cryptocurrency, and related businesses. The advisory describes personalized fictional employment or investment scenarios and attempts to deliver malware. It is context about North Korean targeting, not evidence that every tactic was used against JumpCloud. (FBI/IC3 advisory)
How many JumpCloud customers were affected?
JumpCloud reported an impact of fewer than five customers and fewer than 10 devices, out of more than 200,000 organizations using its platform. These are company-reported upper bounds, not exact counts or an independently audited customer total. JumpCloud said it contacted the affected organizations. Its September 2023 update says customers who were not contacted and informed of impact were not affected by this incident.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
The company’s disclosed scope does not specify how many affected organizations were cryptocurrency businesses, whether customer data beyond the targeted devices was accessed, or any confirmed financial loss. No incident-specific stolen-cryptocurrency amount is established in the cited disclosures.
What JumpCloud says it did after the intrusion
JumpCloud reported rebuilding affected infrastructure, reviewing and reworking identity-and-access-management permissions, adding multi-party authorization for access to data that could affect customer devices or security, rotating keys and credentials, and expanding monitoring. It also said it verified that no source code or binary releases were compromised. These are the company’s reported response measures; they are not independent proof that every residual risk was eliminated. (JumpCloud’s September 2023 update)
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
How crypto companies can reduce the risk
The incident shows why controls must cover both employees’ devices and the trusted platforms that manage them. The FBI’s recommendations address social engineering and protection of company assets; JumpCloud’s account also highlights the value of limiting privileged access and requiring additional authorization for sensitive actions.
Verify people and prevent untrusted code execution
- Verify unexpected employment, investment, or business contacts through a separate communications channel, using contact details you already trust.
- Do not run unknown code or pre-employment tests on company-connected devices. Use an isolated environment for legitimate testing when appropriate.
Limit access and add independent approvals
- Give employees and service accounts only the access needed for their roles, especially for code repositories, sensitive documentation, device-management systems, and financial controls.
- Require multiple authentication factors and approvals across several unconnected networks before company financial assets are moved, as the FBI recommends. A FIDO2 hardware security key can be one way to add a factor; the FBI guidance does not claim that a specific key would have prevented the JumpCloud incident.
- Require a second authorized person for high-impact changes to device-management commands, identity permissions, credentials, or customer-affecting data.
Prepare to detect and contain a compromise
- Keep logs that can reveal unusual administrator activity, unexpected command changes, and access from unfamiliar devices or locations; make sure someone is responsible for reviewing alerts.
- Maintain a response plan for revoking access, rotating credentials and keys, isolating affected devices, and contacting customers or partners.
For an organization that suspects compromise, the FBI advises disconnecting affected devices, preserving evidence, filing a report with the Internet Crime Complaint Center (IC3), and discussing incident response and forensic examination with law enforcement. (FBI/IC3 guidance on prevention and response)
Quick Recap
Best Value
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
