North Korean IT Operatives Exposed Earning $1 Million a Month Through Crypto Scams

North Korean hackers have long used false identities to apply for remote IT jobs, gaining access to private keys, core code and internal systems after infiltrating blockchain and AI companies. Such attacks not only lead to cryptoasset theft but also increase the risks facing multinational companies in employee screening and supply-chain security.

A Chainalysis report found that North Korean hackers stole about $2.02 billion in cryptoassets in 2025, up 51% year on year and accounting for roughly 60% of the global total stolen. CertiK put the figure at $2.06 billion. In a recent case, an interviewer exposed a North Korean operative posing as a Japanese engineer by asking the applicant to criticize Kim Jong Un.

North Korea has long used state-backed hacking groups to target cryptocurrency exchanges and related services. Blockchain security firm CertiK said the country has “industrialized” such theft, turning it into a core channel for evading international sanctions and obtaining foreign currency. The proceeds have also been used to fund its nuclear weapons and missile programs.

CertiK’s latest report showed that North Korea-linked hacking groups stole about $2.06 billion in cryptocurrency in 2025, accounting for roughly 60% of global losses from crypto hacks that year. The report said North Korea has built systematic operations spanning attacks, asset transfers and money laundering, indicating that the activity has evolved from isolated crimes into a state-level revenue model.

North Korea-linked hacking groups have long targeted cryptocurrency platforms, with organizations such as Lazarus particularly adept at attacking DeFi protocols. Because stolen assets can be moved rapidly across borders, such attacks not only threaten investors and protocol security but also renew concerns about North Korea obtaining funds through digital assets.

A TRM Labs report found that North Korea-linked hackers accounted for 76% of total cryptocurrency thefts in 2026. In April, hackers stole about $577 million from DeFi protocols including Drift Protocol and Kelp DAO over 18 days. Global crypto hack losses exceeded $630 million that month, the highest since February 2025.

North Korea has long dispatched IT workers overseas to apply remotely for technology jobs using false identities, stolen data belonging to U.S. residents and “laptop farms,” then remit most of their salaries to Pyongyang. Such operations target blockchain and cryptocurrency companies and may also involve planting malware and stealing confidential information. The proceeds are alleged to fund North Korea’s nuclear weapons and ballistic missile programs.

On March 12, 2026, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned six individuals and two entities, saying the network generated nearly $800 million for North Korea in 2024. A Vietnam-based operator converted about $2.5 million in cryptocurrency between mid-2023 and mid-2025. On April 15, the U.S. Justice Department separately announced that two accomplices had been sentenced to 92 and 108 months in prison for helping infiltrate more than 100 companies and generate over $5 million in revenue.

North Korea has long faced sweeping United Nations sanctions that restrict its legal exports and access to the financial system. It has consequently made cryptocurrency theft an important source of foreign currency to fund its nuclear weapons and ballistic missile programs. SVRN Chief Operating Officer Dave Schwed said Pyongyang targets exchanges, wallets and DeFi platforms rather than treating cryptocurrency merely as a payment tool.

CoinDesk reported on April 12, 2026, that North Korean hackers had recently spent six months infiltrating Drift, using false identities and long-term relationship-building to gain critical access. In the February 21, 2025, attack on Bybit, they moved $1.5 billion in about 30 minutes. The incident underscored both the difficulty of reversing on-chain transactions and the extremely short window for blocking stolen funds.

North Korea has long used IT workers posing as overseas contractors to secure blockchain development work, earning foreign currency and gaining access to core DeFi privileges. Security researcher Taylor Monahan said some of these workers have more than seven years of experience. The networks are believed to have ties to Lazarus Group, highlighting shortcomings in existing identity screening and defense strategies.

A recent investigation found that North Korean IT workers had infiltrated more than 40 crypto platforms and DeFi protocols, and were suspected of outsourcing work to non-North Koreans. Related attacks include the theft of about $625 million from Ronin Bridge in March 2022 and the theft of about $235 million from Indian exchange WazirX in July 2024.