How North Korean Hackers Infiltrate the Crypto Assets Industry

A recent survey revealed that several well-known Crypto Assets companies unknowingly hired IT workers from North Korea. These workers successfully applied using fake identities, passed background checks, and provided seemingly authentic work experience.

Investigations found that at least a dozen crypto companies inadvertently employed North Korean IT personnel, including well-known projects such as Injective, ZeroLend, Fantom, Sushi, Yearn Finance, and Cosmos Hub.

These North Korean IT workers often use fake passports and IDs, and some have an impressive GitHub code contribution history. Their technical abilities vary; some can only "mix a few months' salary," while others perform exceptionally well.

Hiring North Korean workers in countries that impose sanctions, such as the United States, is illegal and poses security risks. Investigations have found that multiple companies were attacked by hackers after employing North Korean IT personnel.

Famous blockchain developer Zaki Manian stated: "In the entire crypto industry, the proportion of resumes, job seekers, or contributors from North Korea may exceed 50%. Everyone is trying to filter these people out."

Some companies, upon learning that employees may come from North Korea, recalled some unusual situations, such as employees' working hours not matching the local time zone or multiple people impersonating one individual.

In 2021, Sushi suffered a $3 million Hacker attack, related to two suspected North Korean developers they employed. These developers submitted malicious code to the MISO platform, transferring funds to wallets they controlled.

Experts indicate that North Korean IT workers are closely related to the country's Hacker activities. They obtain information through methods such as social engineering or directly access systems, contributing to North Korea's cyber attacks.

This survey reveals for the first time the extent to which North Korean IT workers are infiltrating the encryption industry, highlighting the vulnerabilities in background checks of related companies. Crypto assets companies need to be more vigilant and strengthen security measures to guard against this covert threat.