How North Korean IT Workers Penetrate the Crypto Assets Industry

A recent survey revealed that several well-known Crypto Assets companies unknowingly employed IT workers from North Korea, including Injective, ZeroLend, Fantom, Sushi, Yearn Finance, and Cosmos Hub.

These North Korean employees successfully passed interviews and background checks using fake identification cards and provided seemingly real work experience. In countries like the United States that impose sanctions on North Korea, it is illegal to employ North Korean workers. This also poses security risks, as multiple companies have faced hacker attacks after hiring North Korean IT workers.

Famous blockchain developer Zaki Manian stated that in the entire encryption industry, the proportion of resumes, job seekers, or contributors from North Korea may exceed 50%. He himself inadvertently hired two North Korean IT workers in 2021 to help develop the Cosmos Hub blockchain.

The encryption industry is particularly susceptible to infiltration by North Korean IT workers. The workforce distribution in this industry is very globalized, and companies are often more willing to hire completely remote or even anonymous developers. North Korean workers apply for jobs through various channels, including Telegram, Discord, professional job boards, and recruitment websites.

Many employers have stated that when they discover that an employee may be North Korean, some previous unusual behaviors become more significant. For example, discrepancies between working hours and claimed locations, or multiple people impersonating one employee, etc. Some companies immediately fired the relevant employees and strengthened security measures upon discovery.

In addition to legal risks, hiring North Korean IT workers may also pose security risks. CoinDesk found multiple cases where crypto projects that employed North Korean staff later faced hacking attacks. In 2021, Sushi experienced a $3 million hack after hiring two developers associated with North Korea.

North Korean IT workers are often associated with hacking activities. They can obtain personal information used for sabotaging targets or directly access systems containing a large amount of Crypto Assets. In recent years, North Korea has stolen over $3 billion in crypto assets through hacking attacks.

Although countries like the United States have not yet prosecuted crypto companies that employ North Korean IT workers, such actions are still illegal and carry significant risks. The crypto industry needs to be vigilant, enhance background checks, and prevent the infiltration of North Korean IT workers. At the same time, better international cooperation is needed to address this threat.