Ethereum Foundation helps expose North Korean infiltrators

TLDR

Ethereum Foundation helped uncover about 100 North Korealinked IT workers embedded in crypto firms through a six?month security program, revealing serious human?level infiltration risks for Web3.

1. Ethereum (ETH): its ETH Rangers program funded the Ketman Project, which identified roughly 100 DPRK IT workers across 53 crypto projects and built tooling to spot them.
2. The findings connect these fake developers to long?running North Korean hacking operations behind several major exploits and show that hiring pipelines are now a primary attack surface.
3. Crypto teams and users should watch for stronger hiring checks, adoption of open detection frameworks, and more public security disclosures when assessing protocol risk.

Deep Dive

1. How Ethereum Helped Expose The Network

The Ethereum Foundation launched the ETH Rangers program in late 2024 to fund public?goods security research across the ecosystem.

One recipient created the Ketman Project, which focused on fake developers working inside Web3 organizations. Over six months, Ketman identified around 100 IT workers linked to North Koreas DPRK operating under false identities and contacted about 53 projects that appeared to have hired them, according to multiple reports and the Foundations own recap of ETH Rangers.

Investigators documented tell?tale patterns such as reused avatars and metadata across GitHub accounts, inconsistent device language settings, and accidental exposure of unrelated email addresses, then packaged this into an open?source detection tool and a DPRK IT Workers Framework co?authored with the Security Alliance (SEAL). These resources are now publicly available for other teams to use.

2. Why DPRK Infiltration Is A Big Deal

North Korean state?linked groups, especially Lazarus, have been tied to billions of dollars in crypto thefts, including bridge and exchange exploits. Recent reporting links DPRK?style infiltration tactics to major incidents such as the Drift Protocol exploit on Solana and other large hacks.

What is new here is the scale of human infiltration. Instead of only attacking code from the outside, DPRK workers pose as legitimate remote developers, pass interviews, and gain long?term access to repos, admin tools, and infrastructure.

The same week these ETH Rangers results were published, the U.S. Department of Justice announced multi?year prison sentences for Americans who helped DPRK IT workers pose as U.S. developers, underscoring that regulators now treat this as a sanctions and national?security issue, not just ordinary cybercrime.

3. What Crypto Teams And Users Should Watch

For projects, the clearest implication is that basic hiring and access?control hygiene is now part of protocol security, especially for remote contributors and contractors. That can include stronger identity checks, sanctions screening, and segmented permissions, using frameworks like the KetmanSEAL DPRK IT Workers guide and related open?source tools.

For users, one practical lens is how transparent a protocol is about security programs. Public collaboration with independent researchers, clear post?mortems, and visible use of industry frameworks are all signals that a team is taking these risks seriously.

Conclusion

Ethereum Foundations backing of ETH Rangers and the Ketman Project shows that state?linked infiltration of crypto teams is real and measurable, not just a theoretical risk.

The discovery of around 100 DPRK?linked workers across dozens of projects highlights a shift in attack patterns from purely technical exploits toward long?term human compromise.

Going forward, the projects that are most resilient are likely to be the ones that pair solid smart?contract engineering with rigorous contributor vetting, access controls, and open collaboration with the broader security community.