Ethereum-Funded Probe Uncovers 100 North Korean IT Workers in Web3

North Korea has long deployed IT workers under fabricated identities to earn foreign currency and secure access to overseas companies, creating risks that extend from payroll fraud to reconnaissance and asset theft. The Ethereum Foundation launched ETH Rangers in late 2024 to fund public-goods security work across its ecosystem. One grant supported the Ketman Project, which focuses on detecting fake developers embedded in Web3 organizations and strengthening personnel screening against state-linked threats.

The Ethereum Foundation published its six-month program recap on April 16, 2026. The Ketman Project identified 100 North Korean IT workers operating under false identities and contacted about 53 Web3 projects that may have employed active DPRK operatives. Across the broader ETH Rangers program, 17 security researchers reported more than 785 vulnerabilities and helped recover or freeze over $5.8 million, while Ketman also developed an open-source tool for detecting suspicious GitHub activity.