North Korean IT Workers Infiltrate Crypto Companies, Earning $17 Million

By: Isha Das

An in-depth on-chain investigation has uncovered that North Korean IT workers, posing adeptly as foreign developers, have successfully integrated themselves into the crypto and blockchain space. They have managed to earn approximately $17 million this year by concealing their true identities and locations. The findings, brought to light by renowned blockchain investigator ZachXBT, reveal that these operatives have filled around 345 to possibly 920 positions across various crypto startups.

Interestingly, these IT workers have managed to embed themselves deep within crypto projects with monthly earnings per role ranging between $3,000 and $8,000, leading to an estimated monthly payout of about $2.76 million. A crucial aspect of their operation is the use of crypto wallets, particularly holding balances in USDC, which have even been linked directly to Circle accounts. This discovery underlines vulnerabilities in Circle’s compliance, with transactions traced back to blacklisted wallets associated with North Korean actors.

The investigation by ZachXBT also unearths the misconception that US exchanges have stricter KYC/AML regulations compared to offshore platforms. Many of these North Korean IT workers have connections with prominent exchanges like Coinbase and Robinhood, and they frequently utilize MEXC for laundering activities. Notably, Binance was once a preferred platform, but due to improved detection systems and industry collaborations, its usage has dwindled significantly.

ZachXBT highlights how advancements in neobanks and fintech companies offering stablecoin integration have compounded the issue, making it easier for North Korean operatives to convert fiat currencies into crypto-assets. Warning signs of North Korean infiltration include repeated failed KYC attempts, abstention from in-person meetings, frequent VPN usage with Russian IPs, and shared recommendations among themselves within projects.