North Korean IT Workers Create 30 Fake Identities for Crypto Exploits

By: Eliza Bennet

In a stunning revelation, blockchain investigator ZachXBT has unveiled a complex operation involving North Korean IT workers using 30 fake identities to infiltrate Western technology companies, with significant ties to cryptocurrency exploits. According to the detailed reports, these operatives have been involved in high-profile cybercrimes, including the $680,000 hack of fan-token marketplace Favrr in June, among others. The team of operatives, as outlined in documents shared by ZachXBT, systematically purchased social security numbers, Upwork and LinkedIn accounts, and even rented computers to secure employment in various technology projects.

The operatives leveraged a variety of tools and platforms such as Google products to organize and execute their tasks, meticulously maintaining fake identities with robust backstories and professional personas like "Henry Zhang." Payment transactions were linked to a specific wallet address that connected multiple fraudulent operations, revealing a staggering network of deceitful activities. These digital trails have further tied the North Korean workforce to the 2025 $1.4 billion exploit of a crypto exchange, indicating a widespread infiltration strategy targeting not only small projects but also major industry players.

The modus operandi included the use of AnyDesk for remote system access, VPNs, and proxies to mask real identities, and utilizing translation tools like Google Translate to bridge language barriers. Despite their unsophisticated technological skills, their persistence, coupled with the lack of collaboration between services and recruitment negligence, has enabled them to remain operative in the competitive job market. ZachXBT’s findings point to a massive scale of infiltration, emphasizing the urgent need for more robust defensive measures from both public and private sectors to safeguard against such sophisticated cyber threats.

The revelations highlight the critical nature of international cooperation in cybersecurity, urging immediate action to counteract these persistent threats. As these North Korean schemes continue to evolve, the technology community faces the challenge of staying ahead of these adversaries while securing digital platforms against future breaches.