United

Bitcoin

ZachXBT

Blockchain investigator ZachXBT says he’s uncovered evidence of a sophisticated network of North Korean developers that earn as much as $500,000 a month working for “established” crypto projects.
In an Aug. 15 <a href="https://x.com/zachxbt/status/1824047425822310580" target="_blank" rel="noopener nofollow">post</a> on X, ZachXBT informed his 618,000 followers he believes a “single entity in Asia,” likely operating out of North Korea, is receiving $300,000 to $500,000 per month employing at least 21 workers to over 25 crypto projects. 
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-08/d8952638-de70-4aa4-8c1a-9229ba37a499.jpg" alt="ZachXBT claims 21 North Korea crypto devs are making $500K a month">
 <figcaption style="text-align: center;">
 Blockchain researcher ZachXBT claims to have found that 21 North Koreans using fake identities are working on dozens of crypto projects. Source: ZachXBT
 </figcaption>
</figure>
“Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed,” ZachXBT said.&nbsp;
<blockquote data-ct-non-breakable="true">
 “Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities.”
</blockquote>
ZachXBT alleges that the latest $1.3 million stolen by DPRK workers was laundered through a sequence of transactions, including transferring to a theft address and ending with 16.5 Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>) going to two <a href="https://cointelegraph.com/learn/what-are-decentralized-exchanges-and-how-do-dexs-work">different exchanges</a>.
After further investigation into these devs, ZachXBT believes they are part of a much more extensive network.
Tracking multiple payment addresses, he found a cluster of developers receiving “$375,000 over the last month,” and previous transactions totaling $5.5 million, which flowed into an exchange <a href="https://cointelegraph.com/learn/types-of-bitcoin-addresses">deposit address</a> from July 2023 to some time in 2024. 
Related: <a href="https://cointelegraph.com/news/zachxbt-flags-61m-bitcoin-lazarus-hackers">ZachXBT flags Lazarus-linked addresses worth $61M</a>
These payments were then linked to IT workers in North Korea, and an individual Sim Hyon Sop — who has been sanctioned by the Office of Foreign Assets Control (OFAC) for <a href="https://cointelegraph.com/news/ofac-sanctions-otc-traders-who-converted-crypto-for-north-korea-s-lazarus-group">allegedly coordinating financial transfers</a> that eventually ended up supporting North Korea’s weapons programs.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-08/94fa61aa-8d8c-492e-9dca-e4026500f27a.jpg" alt="ZachXBT claims 21 North Korea crypto devs are making $500K a month">
 <figcaption style="text-align: center;">
 A cluster of developers ZachXBT believes to be North Koreans using fake identities have received $375,000 over the last month. Source: ZachXBT
 </figcaption>
</figure>
ZachXBT says his investigation uncovered other payment addresses were closely linked to another OFAC-sanctioned individual, Sang Man Kim, who has been <a href="https://cointelegraph.com/news/binance-us-authorities-freeze-crypto-dprk-cybercrime">linked to DPRK-related cybercrime</a> in the past.&nbsp;
US law enforcement believes Kim is “involved in the payment of salaries to family members of Chinyong’s overseas DPRK worker delegations” and receiving $2 million in crypto for selling IT equipment to DPRK-affiliated teams in China and Russia.
ZachXBT also found instances of Russian Telecom IP overlaps among developers who claimed to be based in the United States and Malaysia. At least one of the workers “accidentally leaked their other identities on a notepad.” 
Some of the devs he found were even placed by recruitment companies and in some cases, referred each other for work.
“A number of experienced teams have hired these devs so it’s not fair to them single as the ones to blame,” ZachXBT said.&nbsp;
<blockquote data-ct-non-breakable="true">
 “Shortly after posting another project found out they had hired one of the DPRK IT worker (Naoki Murano) listed in my table and shared my post in their chat. Immediately within two minutes, Naoki left the chat and wiped his GitHub.”
</blockquote>
Organizations linked to the Democratic People’s Republic of Korea (DPRK) are believed to be behind more than a few <a href="https://cointelegraph.com/news/north-korea-hackers-stole-crypto">cyber attacks and other scams</a> over the years. Its cybercrime modus operandi generally involves phishing, exploiting software flaws, cyber intrusions, private key exploits and in-person infiltration. It is understood some also work these jobs to generate a salary which is then sent back to the country.&nbsp;
In 2022, the US Departments of Justice, State and Treasury <a href="https://home.treasury.gov/system/files/126/20220516_dprk_it_worker_fact_sheet.pdf" target="_blank" rel="noopener nofollow">issued</a> a joint advisory warning about the <a href="https://cointelegraph.com/news/us-agencies-warn-against-the-influx-of-north-koreans-in-it-and-crypto-jobs-online">influx of North Korean workers</a> into various freelance tech jobs, especially crypto.
Arguably, the most infamous group linked to the hermit kingdom, the Lazarus Group, reportedly <a href="https://cointelegraph.com/news/north-korean-hackers-stolen-crypto">stole over $3 billion in crypto</a> assets in the six years leading up to 2023.
Magazine: <a href="https://cointelegraph.com/magazine/ai-more-power-hungry-bitcoin-profits-pose-risks-bitcoin-miners/">AI may already use more power than Bitcoin — and it threatens Bitcoin mining</a>

ZachXBT claims 21 North Korea crypto devs are making $500K a month

Cointelegraph

Other articles published on Aug 16, 2024

Binance to Pay $1.76 Million Settlement for Unlicensed Derivatives Trading in Brazil

Malaysia Adopts Worldcoin’s Iris Technology for Digital Verification

Bitcoin: $160 Billion Added by HODLers! A Record

Grayscale Expands Crypto Offerings with Bittensor and Sui

OpenAI shuts down Iranian group’s ChatGPT accounts over U.S. election influence campaign

Prominent investors announce investment and support for TOKYO BEAST!

Join our free newsletter for daily crypto updates!