North Korean Operatives Expand Blockchain Infiltration into Europe Amid U.S. Scrutiny

North Korean operatives have expanded their infiltration tactics into European blockchain firms, particularly in the United Kingdom. These operatives, linked to North Korea, are leveraging fake identities and sophisticated methods to gain access to high-value projects within these firms. This shift comes as a response to increased scrutiny from U.S. authorities, which has prompted these actors to seek employment opportunities beyond American borders.

According to Google’s Threat Intelligence Group (GTIG), these operatives disguise themselves as legitimate remote workers, securing positions within firms that handle sensitive blockchain and artificial intelligence projects. The tactics employed by these operatives include the creation of a global network of fake identities, new extortion strategies, and the exploitation of corporate bring-your-own-device (BYOD) policies to evade detection.

Jamie Collier, an adviser with GTIG, noted that these operatives have adapted their operations in response to growing awareness in the U.S., pivoting toward European markets where scrutiny remains lower. The report outlines how North Korean operatives pose as professionals from various countries, including Italy, Japan, Malaysia, Singapore, Ukraine, the U.S., and Vietnam. Many of these operatives use fake credentials and references to gain access to companies handling cutting-edge blockchain and AI projects.

Some of the identified activities include developing blockchain-based platforms using technologies such as Solana, Anchor, Cosmos SDK, and Rust. Another activity is the creation of a job marketplace utilizing the MERN stack and Solana. Collier further warned that the presence of enablers within the UK suggests the formation of a broader support network, enabling these operatives to persist in their schemes.

The GTIG report also highlights a troubling rise in extortion tactics by dismissed North Korean IT workers. Since October, these workers have increasingly resorted to threatening former employers with data leaks, seeking to sell proprietary information to competitors or expose internal project details unless paid off. This data often includes proprietary code and critical company intelligence. This escalation coincides with intensified U.S. law enforcement actions, including indictments and disruptions targeting North Korean operatives.

The U.S. Department of Justice recently indicted two North Korean nationals for orchestrating a fraudulent IT employment scheme that involved more than 60 companies. The U.S. Treasury has also sanctioned entities accused of operating as front companies for North Korean IT activities. These operatives’ tactics have expanded beyond mere infiltration. Previously, when IT workers were dismissed, they would attempt to re-enter companies under different identities. However, recent firings have resulted in outright extortion, indicating a shift toward more aggressive financial exploitation strategies.

In response to these threats, Google UK has introduced stricter policies on crypto-related advertisements to combat fraudulent activities. Starting January 15, 2025, all digital asset exchanges and wallet providers seeking to advertise in the UK must register with the Financial Conduct Authority (FCA). The UK’s FCA has been actively clamping down on misleading crypto promotions. These regulatory actions align with broader global trends, where authorities have mandated pre-approval for crypto-related advertisements.

With cyber threats intensifying and regulatory oversight increasing, UK-based crypto firms must remain vigilant to protect their businesses from both external and internal risks. The evolving tactics of North Korean operatives underscore the need for enhanced security measures and vigilance within the blockchain and AI sectors. Firms must be proactive in identifying and mitigating potential threats to safeguard their sensitive projects and proprietary information.