A shocking piece of information about the blockchain industry was revealed at the Devconnect event, when Pablo Sabbatella – founder of Web3 auditing unit Opsek and member of the Security Alliance (SEAL) security group – warned that the level of infiltration by North Korean agents into the cryptocurrency sector is “much larger than imagined”. According to the Chia published on November 24, he said that 15% to 20% of crypto companies today are unwittingly hosting “personnel” who are North Korean agents, and 30% to 40% of job applications in the industry are likely related to groups backed by Pyongyang.
Blocked by international sanctions, North Korean hacker groups and agents cannot directly apply for jobs on blockchain projects. Instead, they deploy a more sophisticated tactic: hiring or luring workers from developing countries such as Ukraine, the Philippines, Pakistan, or India to act as “front men.” These workers are required to hand over account access, or allow the use of remote identities to hide their true origins. The profit- Chia model is set up very clearly: front men only receive about 20% of the income, while the remaining 80% flows to the North Korean coordination group.
An even more worrying tactic is that they recruit American citizens to act as “facades”. These Americans are often arranged to interview under the name of “Chinese people who are not good at English” to avoid suspicion. Their computers are installed with malware to take control, exploit IP addresses in the US, then legitimize their login activities, access websites, and bypass security barriers. When these subjects are hired by the company, they become the type of hard-working, less complaining, stable employees, so they often hold positions for a long time without anyone being alert.
According to Sabbatella, there is one telltale sign: members of this network generally avoid criticizing North Korean leader Kim Jong-un, as it is strictly forbidden. He notes that the weak security of many crypto businesses makes it easy for “social engineering” attacks to take effect, and the founders’ computers are often infected with malware without their knowledge.
