North Korean hacking group Famous Chollima has been identified as the perpetrator behind a sophisticated attack on the open-source crypto trading project openpaw-graveyard. ReversingLabs discovered that the group used a malicious npm package named PromptMink, which was generated by Anthropic’s Claude Opus AI model, to steal cryptocurrency wallet credentials and system keys. Since September 2025, Famous Chollima has employed a two-layer strategy to distribute these malicious npm packages. Initially, they release a "bait" package devoid of harmful code, followed by a second-layer package that executes the attack. The group has been quick to deploy replacement versions whenever the second-layer package is removed, maintaining their malicious activities.