North Korean IT Workers Rake in Millions Through Crypto Scams
By John Nada·Apr 9, 2026·7 min read
North Korean IT workers reportedly earned over $3.5 million through crypto scams, revealing a sophisticated threat to the industry. Their operations highlight the need for enhanced security measures.
A group of North Korean IT workers made more than $3.5 million in just a few months by faking their identities to work as developers while also attempting to hack crypto projects, according to documents obtained by a hacker who compromised one of their devices. The leaked data obtained by the unnamed hacker was shared by blockchain sleuth ZachXBT in a post to X on Wednesday. It revealed that one of the IT workers, “Jerry,” and a team of 140 members were making roughly $1 million a month, amounting to $3.5 million worth of crypto since late November.
The North Korean IT workers coordinated payments on a website called “luckyguys.site” using a shared password, “123456,” ZachXBT said, adding that some of the users on that platform appeared to work for Sobaeksu, Saenal, and Songkwang, which are sanctioned by the U.S. Office of Foreign Assets Control. This demonstrates not only the audacity of these operatives but also the reliance on established networks that are already under scrutiny for their illicit activities.
Payments made in crypto were converted to fiat and sent to Chinese bank accounts via online payment platforms like Payoneer. This method of operation highlights the increasing sophistication of laundering techniques employed by North Korean hackers, allowing them to conceal their tracks while reaping financial gains from their scams. Tracing these wallet addresses revealed links to other known North Korean wallets that were blacklisted by Tether in December, showcasing a broader network of illicit financial movements that may extend beyond the immediate activities of this group.
North Korean hackers have a long-standing and notorious history of targeting the crypto sector, amassing over $7 billion in stolen funds since 2009. The frequency and audacity of these attacks have raised alarms across the globe, prompting significant concerns among cybersecurity experts and regulatory bodies. Among the most notable incidents are the $1.4 billion hack of the Bybit exchange and the $625 million Ronin bridge breach, both of which have left indelible marks on the crypto landscape.
The recent revelations about the North Korean IT workers underscore the persistent threat posed by state-backed actors, who are becoming increasingly sophisticated in their methods. The techniques employed by these hackers continue to evolve, posing significant security challenges for the crypto industry. The $280 million hack of the Drift Protocol on April 1 further exemplifies the relentless nature of these attacks, indicating that the threat is not only ongoing but also escalating.
Interestingly, the data shared by ZachXBT included a leaderboard showing how much crypto each IT worker had brought in for the organization since December 8. This gamification of their illicit activities indicates a structured and competitive environment within the group, reflecting a level of organization that is often associated with legitimate tech companies. Additionally, links to blockchain explorer pages showcasing transaction details provide a stark reminder of how transparent blockchain technology can be, even as it is manipulated for nefarious uses.
Among the IT workers, “Jerry” utilized an Astrill virtual private network to access Gmail, where he submitted several applications for full-stack developer and software engineer roles on job platforms like Indeed. This highlights the dual strategy employed by these operatives: while engaging in illegal activities, they also sought legitimate employment opportunities to cover their tracks. In one of his unsent emails, Jerry wrote a letter for a WordPress content and search engine optimization specialist position at a T-shirt company in Texas, indicating a desire to blend in with the competitive job market while pursuing his malicious agenda. He sought $30 an hour with availability of 15 to 20 hours a week, a modest ask that could easily slip under the radar of potential employers.
The operational details shared in the leaked documents also reveal instances of identity falsification. One of the IT workers, “Rascal,” shared pictures of a billing statement using a fake name and address in Hong Kong. Additionally, Rascal shared a picture of an Irish passport, although it remains unclear if it was genuinely used for any of their operations. Such tactics reflect a calculated approach to evade detection, showcasing the lengths to which these operatives will go to maintain their anonymity and facilitate their scams.
ZachXBT noted that these IT workers appeared less sophisticated compared to other North Korean groups like AppleJeus and TraderTraitor, which operate far more efficiently and present the greatest risks to the industry. This observation raises important questions regarding the hierarchy and operational capabilities of North Korean cybercriminal organizations. While the group in question has demonstrated a capacity for generating substantial profits through scams, the existence of more advanced and dangerous groups suggests a continuously evolving threat landscape.
The implications of these developments extend beyond the immediate financial losses incurred by victims of these scams. The ongoing threats posed by North Korean hackers serve as a wake-up call for the crypto industry, which must prioritize security and regulatory measures to stave off further attacks. Increased vigilance is essential, along with collaboration among industry stakeholders to share intelligence and develop robust defense strategies.
As the crypto landscape continues to evolve, the sophistication of cyber threats will only increase. Stakeholders must recognize that the intersection of technology and illicit activity presents unique challenges that demand proactive measures. The North Korean IT workers' operations reveal not only the vulnerabilities within the crypto sector but also the necessity for a coordinated response to mitigate these risks effectively.
The regulatory environment surrounding cryptocurrencies has been under scrutiny, with various governments around the world grappling with how best to address the challenges posed by crypto-related crime. Enhanced regulatory frameworks will be crucial in ensuring that the crypto industry remains secure and resilient against threats from state-backed hackers and organized cybercriminals. The need for international cooperation and intelligence sharing cannot be overstated, as these criminals often operate across borders, complicating enforcement efforts.
In light of these recent revelations, the crypto industry must also focus on educating users about the risks associated with crypto investments and the potential for scams. Awareness campaigns can empower individuals to recognize and avoid fraudulent schemes, ultimately contributing to a more secure trading environment. As the landscape becomes increasingly complex, the role of education and awareness in fostering a culture of cybersecurity cannot be underestimated.
Furthermore, the technological advances employed by these North Korean operatives warrant a closer examination. As they leverage tools like virtual private networks and identity falsification, it becomes imperative for cybersecurity professionals to stay ahead of these tactics. Engaging in continuous research and development will enable the industry to identify emerging threats and implement countermeasures effectively.
The North Korean IT workers' ability to generate substantial profits through scams signals a troubling trend that extends beyond their immediate operations. The broader implications of their activities highlight the urgent need for enhanced security protocols and regulatory measures within the crypto industry. As these threats evolve, it is imperative for stakeholders to adopt a proactive approach to safeguarding the integrity of the cryptocurrency ecosystem.
As the world watches the developments in North Korean cyber activities, the lessons learned from these events can serve as a blueprint for addressing similar threats in the future. The ongoing battle between cybercriminals and the entities tasked with protecting digital assets will continue to shape the landscape of the crypto industry, necessitating a commitment to innovation, collaboration, and vigilance.