Ethereum project exposes 100 DPRK crypto workers

TLDR

An Ethereum Foundation-backed security initiative has uncovered around 100 North Korean IT workers secretly embedded in crypto and Web3 projects.

1. An ETH Rangers grant funded the Ketman Project, which identified 100 DPRK-linked workers and alerted about 53 affected projects.
2. These operatives used fake identities to gain trusted roles, linking to broader Lazarus-style campaigns that have stolen billions in crypto.
3. The findings are pushing Web3 teams toward stricter hiring checks, shared threat intelligence, and new open source tools to detect suspicious developer activity.

Deep Dive

1. What The Ethereum Program Found

The Ethereum Foundations six month ETH Rangers initiative funded independent security work across the ecosystem, including a stipend for the Ketman Project.

According to the Foundations recap and follow-up reporting, Ketman focused on fake developers and identified about 100 DPRK IT workers operating inside Web3 organizations, reaching out to roughly 53 projects that had unknowingly hired them under false identities. This is detailed in the ETH Rangers and Ketman coverage from outlets like Cointelegraph and crypto.news, including an ETH Rangers program recap.

Broader ETH Rangers results included more than 785 vulnerabilities reported, over 36 incident responses, and over 5.8 million dollars in funds recovered or frozen, as summarized in an Ethereum-backed security report.

2. How DPRK Workers Infiltrate Web3

Reports say these workers posed as legitimate remote developers or contractors, using layered fake profiles, reused avatars, inconsistent language settings, and suspicious GitHub behavior to mask their origin, as described in a Ketman-focused investigation.

Security researchers link this activity to North Korean state-backed groups such as Lazarus, which have been tied to major thefts like the Ronin Bridge hack and other exchange and DeFi breaches. Decrypt notes that DPRK-linked actors stole around 2 billion dollars in crypto in 2025 alone and are implicated in long-running infiltration campaigns across about 53 projects, as covered in a broader ETH Rangers and Drift exploit report.

Recent incidents like the large Drift Protocol exploit on Solana are suspected to involve DPRK-linked actors who first gained trust via social engineering and then abused high-privilege access, reinforcing the human-infiltration risk.

3. What Changes For Web3 Security

The main shift is from viewing security only as code audits to treating hiring and contributor identity as a core attack surface. Tools and frameworks co-authored by Ketman and the Security Alliance aim to help teams spot red flags in developer accounts and workflows, as highlighted in the DPRK developer analysis.

Industry commentary suggests more projects will tighten background checks for sensitive roles, restrict access keys, and adopt continuous monitoring for suspicious GitHub or DevOps activity, alongside traditional smart contract reviews. Regulators and sanctions bodies are also likely to increase pressure on firms that inadvertently employ sanctioned workers, given the scale of identified infiltration.

Conclusion

The Ethereum-backed ETH Rangers program shows that coordinated security efforts can uncover state-linked infiltration at meaningful scale, exposing around 100 DPRK workers inside dozens of crypto projects. At the same time, it highlights how vulnerable Web3 firms remain to social and hiring based attacks, reinforcing the need for stronger identity checks, privilege management, and shared threat intelligence alongside technical audits.