North Korean IT Workers Infiltrated DeFi for Seven Years, Affecting More Than 40 Crypto Platforms

North Korean hackers have long used false identities to apply for remote IT jobs, gaining access to private keys, core code and internal systems after infiltrating blockchain and AI companies. Such attacks not only lead to cryptoasset theft but also increase the risks facing multinational companies in employee screening and supply-chain security.

A Chainalysis report found that North Korean hackers stole about $2.02 billion in cryptoassets in 2025, up 51% year on year and accounting for roughly 60% of the global total stolen. CertiK put the figure at $2.06 billion. In a recent case, an interviewer exposed a North Korean operative posing as a Japanese engineer by asking the applicant to criticize Kim Jong Un.

North Korea-linked hacking groups have long targeted cryptocurrency platforms, with organizations such as Lazarus particularly adept at attacking DeFi protocols. Because stolen assets can be moved rapidly across borders, such attacks not only threaten investors and protocol security but also renew concerns about North Korea obtaining funds through digital assets.

A TRM Labs report found that North Korea-linked hackers accounted for 76% of total cryptocurrency thefts in 2026. In April, hackers stole about $577 million from DeFi protocols including Drift Protocol and Kelp DAO over 18 days. Global crypto hack losses exceeded $630 million that month, the highest since February 2025.

North Korea has long used overseas IT workers posing as job applicants to infiltrate crypto projects and gain salaries, system access and digital assets. The network uncovered by blockchain investigator ZachXBT involved about 140 people, indicating that the operation had developed into a sizable, sustainable source of foreign currency that could help North Korea evade international sanctions.

As of July 19, 2026, data released by ZachXBT showed that the team earned about $1 million a month from IT jobs and crypto scams. Members used simple passwords such as “123456” to manage payment and ranking platforms. Stolen crypto was converted into fiat currency and then transferred to Chinese bank accounts.