North Korea's Invisible Army: Fake Identities Hijack Crypto Workforce

Changpeng Zhao (CZ), the founder of Binance, has issued an urgent warning about advanced North Korean hackers infiltrating the cryptocurrency industry by posing as job candidates and employers. The threat, which has already resulted in over $1.3 billion in losses in 2024 and an additional $2.2 billion in the first half of 2025, involves sophisticated cybercriminals using elaborate schemes to compromise crypto companies. CZ outlined four primary attack vectors: infiltrating through job applications for developer and security roles, deploying malware via fraudulent interviews, and bribing outsourced vendors for data access. The hackers are described as patient, creative, and well-organized, often using fake identities and corporate fronts to carry out their operations.

Recent investigations have uncovered the formation of legitimate but deceptive U.S. corporations, such as Blocknovas LLC and Softglide LLC, used to infiltrate crypto projects. These entities were operated by North Korean operatives who created fake identities and used professional platforms like LinkedIn and Upwork to secure positions. ZachXBT’s August investigation further revealed that North Korean IT workers have been operating under over 30 fake identities, using government-issued documents and professional accounts to gain employment in crypto firms. The infiltration efforts have expanded to include Python-based malware such as PylangGhost, deployed through fake interview websites that mimic major crypto companies like Coinbase and Robinhood to steal credentials from browser extensions and wallets.

The schemes also involve the establishment of fake companies and the use of stolen identities to maintain a credible presence within the industry. For example, the Lazarus Group, a known North Korean cyber actor, has been linked to a campaign called “Contagious Interview,” which targets crypto wallet developers with malware. These operations are not limited to technical attacks; they also include sophisticated laundering techniques to obscure the origins of funds before routing them back to North Korea’s weapons programs. In June 2025, U.S. authorities seized over $7.7 million in cryptocurrency allegedly earned through networks of covert IT workers posing as foreign freelancers.

The U.S. Department of Justice (DoJ) has taken action against individuals and entities involved in these fraudulent activities. For instance, Sim Hyon Sop, a North Korean Foreign Trade Bank representative, and Kim Sang Man, CEO of state-linked IT firm Chinyong, were identified as key players in the operations. The Justice Department also highlighted the role of facilitators like Christina Marie Chapman, a U.S. citizen who operated a laptop farm to enable North Korean operatives to access American corporate networks. These facilitators helped North Koreans secure jobs, maintain remote access to company laptops, and launder the proceeds of their fraudulent earnings through platforms like Payoneer.

The U.S. Treasury has intensified its efforts to counter these threats by imposing sanctions on individuals and entities linked to the schemes. In June 2025, the Office of Foreign Assets Control (OFAC) sanctioned two North Korean nationals and four Russian entities for their involvement in infiltrating crypto firms. The Treasury also emphasized the importance of disrupting North Korea’s ability to circumvent sanctions through digital asset theft and cyberattacks. The U.S. has further pursued legal action against North Korean hackers, including a recent case in which four North Korean nationals were charged with wire fraud and money laundering after posing as remote workers for U.S. and Serbian blockchain companies.

Experts warn that the tactics used by North Korean hackers are evolving, with a shift from traditional cyberattacks to deception-based revenue generation. This includes targeting crypto professionals through fake job interviews and supply chain attacks, such as inserting malicious JavaScript into GitHub repositories and NPM packages. The use of AI tools like ChatGPT and Google Translate has also enabled these operatives to create convincing personas and navigate complex cultural and technical conversations. Despite increased awareness and regulatory responses, cybersecurity professionals note that the sheer volume of applications and the sophistication of the deception make it difficult to fully mitigate the threat.