North Korean IT Operatives Infiltrate Crypto Projects Using Fake Identities

Blockchain investigator ZachXBT has uncovered a sophisticated operation involving five North Korean IT operatives who allegedly used over 30 fabricated identities to infiltrate cryptocurrency projects. The group reportedly purchased Upwork and LinkedIn accounts, complete with government IDs, to secure developer roles.

Evidence from a compromised device revealed extensive use of Google Drive, Chrome profiles, and spreadsheets detailing operations. Weekly reports from 2025 outlined workflows, while expense logs exposed purchases of Social Security numbers and other fraudulent materials. Communications were conducted primarily in English, with heavy reliance on Google tools for coordination.

The breach highlights ongoing concerns about state-sponsored actors exploiting decentralized ecosystems. While no specific projects were named, the tactic underscores vulnerabilities in crypto hiring practices.