A North Korean state-sponsored hacking group, "HexagonalRodent," has stolen $12 million from Web3 developers in the first quarter of 2026, according to a cybersecurity report by Expel. The group targeted 26,584 cryptocurrency wallets from 2,726 compromised developer devices. Their attacks involved fake job postings on platforms like LinkedIn, embedding malicious code in "skill assessments" that execute malware via VSCode’s tasks.json functionality. The malware, including BeaverTail, OtterCookie, and InvisibleFerret, enables password theft and remote control. HexagonalRodent uses AI tools such as ChatGPT to develop malware and create fake corporate identities, even registering shell companies in Mexico to enhance attack credibility. The group also executed its first supply chain attack by compromising a VSCode extension.