Ethereum-backed probe exposes 100 North Korean operatives

TLDR

An Ethereum Foundation-funded security program has uncovered around 100 North Korea-linked IT workers embedded in dozens of crypto projects, highlighting serious operational and sanctions risks for Web3.

1. An ETH Rangers grant backed the Ketman Project, which spent six months identifying roughly 100 DPRK-linked fake developers and warning about 53 affected crypto teams.
2. Investigators say these operatives used basic identity tricks, infiltrated real codebases, and are tied to past Lazarus-style hacks that have stolen billions in digital assets.
3. The program published open-source detection tools and a DPRK IT worker framework, raising the bar for hiring, sanctions compliance, and security expectations across crypto projects.

Deep Dive

1. What The Probe Found

The Ethereum Foundations six-month ETH Rangers Program funded the Ketman Project, a threat-intel effort focused on uncovering fake developers in Web3 teams. It identified about 100 IT workers linked to North Korea operating under false identities and reached out to roughly 53 projects that may have unknowingly hired them.

According to foundation-aligned reporting, the broader program reported over $5.8 million in funds recovered or frozen and more than 785 vulnerabilities and exploits documented, with the DPRK operatives discovery as one of its headline results. These findings were published in coordination with partners like Security Alliance (SEAL) as part of a push for decentralized defense in the Ethereum ecosystem.

Confidence: high, based on multiple consistent reports and Ethereum Foundation disclosures.

2. Why This Threat Matters

Investigations describe these operatives as long-running infiltrators rather than one-off hackers, tying their activity to North Korean state-backed groups such as Lazarus that have been linked to multibillion-dollar crypto thefts since 2017. One report notes that DPRK-linked activity has touched high-profile incidents including bridge exploits and DeFi attacks, with total stolen funds estimated around $7 billion over the past decade.

The main weakness is not only protocol code but basic operational hygiene: remote hiring with minimal verification, weak background checks, and poor sanctions screening. Red flags documented by Ketman include reused profile photos across GitHub accounts, mismatched device language settings versus claimed nationality, and accidental exposure of unrelated email addresses during screen-sharing.

3. Tools And Next Steps

As part of the ETH Rangers work, Ketman and SEAL released an open-source GitHub profiling tool and co-authored a DPRK IT Workers Framework that documents behavioral and technical indicators of suspected North Korean contractors. These are intended as practical resources for projects to screen contributors and for security teams to review existing staff.

For crypto teams, the signal is that sanctions compliance and identity verification for remote developers are now core security controls, not optional bureaucracy. That includes stronger KYC for contractors, periodic access reviews, and routine checks against frameworks like the DPRK IT worker indicators.

For users, a sensible approach is to watch how protocols respond: projects that acknowledge these risks, engage with community security initiatives, and publish clear incident-response processes are better positioned than opaque teams that say little about internal controls.

Conclusion

An Ethereum-backed investigation has confirmed that North Korean-linked operatives were quietly working inside dozens of crypto projects, turning developer hiring into a front-line security risk. The combination of open-source detection tools and a formal DPRK IT worker framework raises the baseline for how seriously teams must treat identity, sanctions checks, and insider risk. Going forward, protocols that harden these non-technical controls are likely to face lower incident risk and less regulatory pressure than those that do not.