Ethereum Foundation Investigator Expose 100 DPRK IT Workers

• Results come from a six-month ETH Rangers probe by independent security researchers.
• Many of the North Korean workers landed remote developer jobs using fake identities.
• The investigation also recovered or froze over $5.8 million and found 785+ vulnerabilities.

A security probe backed by the Ethereum Foundation has found that about 100 North Korean IT workers infiltrated Web3 firms using fake identities, raising new concerns about vulnerabilities in the crypto industry.

The findings come from a six‑month investigation under ETH Rangers, a grant program that backs independent security researchers.

According to the available information, around 100 North Korea-linked individuals were found working across roughly 53 Web3 and crypto projects, many of whom landed remote developer jobs using fake identities.

The investigation was run by an independent group called the Ketman Project, which specializes in spotting fake online identities and suspicious developer behavior. Researchers reached out to the affected teams, warning that they might have unknowingly hired operatives tied to a foreign government.

For infiltration, the operatives used advanced tactics, building legit‑looking dev profiles on GitHub and freelance sites, acing interviews and onboarding, then getting access to internal systems, code, and potentially funds.

This kind of infiltration takes advantage of a key Web3 trait, which is hiring remotely from anywhere in the world, often with little ID checking.

Beyond just finding infiltrators, the ETH Rangers program also recovered or froze over $5.8 million, found more than 785 vulnerabilities in crypto systems, ran dozens of active incident responses, and reached more than 209,000 people with threat awareness and investigative posts.

North Korea and Web3

North Korea has long relied on cyber operations to steal crypto, commit fraud, dodge sanctions, and fund state programs.

One of the most notorious groups tied to these efforts is the Lazarus Group, which is linked to multiple high-profile crypto exploits. Thousands of North Korean IT workers are thought to be stationed worldwide, using fake IDs to get remote jobs, infiltrate companies, and send money back to the regime.

Crypto and Web3 firms are especially at risk because they hire remotely, often don’t verify identities closely, move fast, and give employees direct access to digital assets and financial systems.

Unlike traditional companies, many crypto projects don’t have strong employee ID checks, mature security systems, or centralized control. All of this makes it easier for cybercriminals to slip in unnoticed. 

Related: Ledger CTO Suspects North Korea Behind $280M Drift Protocol Hack