Michaela
Pablo Sabbatella, a Security Alliance member and founder of Web3 audit firm Opsek, has warned that North Korean operatives may be embedded in as many as 20% of crypto companies, a level significantly higher than previously estimated.
Key Points
- In an interview with DL News, Sabbatella estimated that 30% to 40% of job applications to crypto companies may come from North Korean operatives seeking to infiltrate these organizations
- He emphasized that the threat extends beyond the theft of funds, which has already reached billions
- The larger concern lies in these operatives being hired by legitimate firms, where they could gain access to critical systems and infrastructure that support major crypto platforms
In an interview with DL News, Sabbatella estimated that 30% to 40% of job applications to crypto companies may come from North Korean operatives seeking to infiltrate these organizations. He emphasized that the threat extends beyond the theft of funds, which has already reached billions. The larger concern lies in these operatives being hired by legitimate firms, where they could gain access to critical systems and infrastructure that support major crypto platforms.
Due to international sanctions, North Korean operatives cannot apply for jobs directly. Instead, they recruit unsuspecting remote workers worldwide to act as fronts. Some operatives work as recruiters, enlisting collaborators from outside North Korea who are employed under stolen identities to gain access to crypto company systems and operations.
In August, blockchain investigator ZachXBT uncovered a complex operation in which five North Korean IT operatives reportedly assumed over 30 fake identities to secure developer roles within cryptocurrency projects. According to ZachXBT, the breach exposed extensive data, including Google Drive files, Chrome browser profiles, and device screenshots. The investigation also revealed that the group extensively used Google tools to coordinate schedules, manage tasks, and track budgets, with the majority of their communications conducted in English.
Related: 7 Red Flags in DeFi Scams Every Crypto User Must Learn to Spot
A November report by Security Alliance revealed that North Korean operatives are leveraging freelance platforms like Upwork and Freelancer to target individuals globally, particularly in Ukraine, the Philippines, and other developing nations. The scheme involves recruited workers providing verified account credentials or allowing operatives to remotely use their identities. Collaborators reportedly receive 20% of any earnings, while the North Korean operatives retain the remaining 80%, according to the report.
“What they do to get hired is find someone in the US to become their ‘front-end,’” Sabbatelle explained, pointing out that a majority of North Korean hackers target the US. “So they pretend to be someone from China that doesn’t know how to speak English but they need to get an interview,” he added.
Related: How Multi-Sig Wallets Secure Teams, DAOs, and Shared Crypto Funds
According to Sabbatella, once these operatives secure an interview, they install malware on the front person’s computer, enabling access to a U.S. IP address and broader internet resources unavailable from North Korea. After being hired, the operatives often remain in their positions because they perform effectively, demonstrating high productivity, long hours, and minimal complaints.
MICHAELA
Michaela is a news writer focused on cryptocurrency and blockchain topics. She prioritizes rigorous research and accuracy to uncover interesting angles and ensure engaging reporting. A lifelong book lover, she applies her passion for reading to deeply explore the constantly evolving crypto world.
