North Korean Hackers Establish U.S. Shell Companies to Target Crypto Developers

North Korean hackers linked to the Lazarus Group have infiltrated the cryptocurrency sector by setting up fraudulent U.S. companies. Two entities, Blocknovas and Softglide, were registered in New York and New Mexico using fabricated identities—part of a broader campaign to compromise crypto developers.

The operation reflects Pyongyang’s escalating sophistication in cybercrime. Lazarus Group, a state-backed hacking unit, has stolen billions in digital assets through social engineering and malware attacks. This marks a rare instance of North Korean operatives establishing legal corporate fronts on American soil.

"These shell companies weaponize job opportunities," said Kasey Best of Silent Push, which uncovered the scheme. "Applicants interacting with these entities risk exposing sensitive project data or credentials." The revelation underscores persistent security vulnerabilities in crypto’s talent pipeline.