The post North Korean hackers pose as IT workers to infiltrate crypto projects and exchanges appeared on BitcoinEthereumNews.com.

North Korean hackers regularly apply to Binance. Investigators have also intercepted resources of hackers spinning up identities to apply to key IT jobs.  The threat of DPRK hackers posing as IT workers is still active. Sources have discovered recent data on the techniques used to spin up fake identities and apply as IT workers.  ZachXBT, known for tracking DPRK hackers, recently discovered information from one of the attacker’s devices. ZachXBT has often called out the risk of hiring DPRK workers, which leads to risks for smart contracts, multisig wallets, or compromised devices. An unnamed source pointed to records of five DPRK hackers, spinning up 30 identities and applying to key IT tasks in crypto and other projects.  1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects. pic.twitter.com/DEMv0GNM79 — ZachXBT (@zachxbt) August 13, 2025 The teams used fake locations, local names, and identities, overlapping with crypto-friendly countries like Ukraine and Estonia.  North Korean IT workers scour job boards  Leaked documents showed the tools and tracking used by the team, including attempts to build the fake identities.  The hackers used shared documents, revealing a series of Upwork credit purchases. The finding coincides with reports of attempts to buy or rent Upwork accounts and bid on software jobs. Some of the most common jobs included various blockchain roles, smart contract engineering, as well as work on specific projects, including Polygon Labs. Earlier reports showed that not all North Korean IT workers had hacking in mind or targeted crypto. Some of the workers had the task of earning from legitimate IT jobs, later handing over their pay to the North Korean regime.  An escaped…

---

Filed under: News - @ August 13, 2025 4:26 pm