Sam Kessler's investigation reveals a concerning infiltration of North Korean IT workers into the cryptocurrency industry, highlighting how these individuals have managed to secure positions within prominent blockchain projects. More than a dozen companies, including well-known names like Cosmos, SushiSwap, and Yearn Finance, have inadvertently employed these workers, exposing themselves to significant security and legal risks. The background of this issue is critical. U.S. and UN authorities have identified North Korean IT workers as a means of funneling funds back to Pyongyang, which supports the country's weapons of mass destruction (WMD) programs. The UN has proposed stringent sanctions against these workers, and hiring them, even unintentionally, is illegal in the U.S. and many other jurisdictions. Despite the legal implications, no companies in the U.S. have faced prosecution for employing North Korean workers, which raises concerns about the potential security threats posed by these hires. Kessler's investigation indicates that a substantial portion of cybercrimes attributed to North Korea in 2024 involved these IT workers. For instance, Chainalysis reported that around half of the DPRK-related heists they tracked this year were linked to these individuals. The investigation uncovered specific incidents, such as a hack at SushiSwap that appeared to involve North Korean workers. One notable case involved the crypto company Truflation, which hired five employees claiming to be based in various global cities. These employees presented convincing credentials, including real-looking IDs and active GitHub profiles. However, the founder, Stefan Rust, later discovered that all five were North Korean. Shortly after this revelation, Truflation suffered a significant hack, losing $7 million. Another example is the MISO project from SushiSwap, which lost $3 million in a 2021 heist. Two developers associated with the project, who claimed to be from the U.S. and Serbia, were later linked to North Korea through blockchain data. Similarly, the CEO of Iqlusion, Zaki Manian, hired two developers who were later found to be funneling their wages back to North Korea, leading to an FBI investigation. Manian noted that the prevalence of North Korean developers in the crypto space is alarmingly high, estimating that over 50% of incoming job applications could be from North Korea. This sentiment was echoed by others in the industry, indicating a widespread issue that many companies may not fully recognize. Kessler's reporting was supported by various experts and sources, including Chainalysis and ZachXBT, who had previously exposed several North Korean IT workers. The investigation sheds light on a critical and underreported aspect of the cryptocurrency industry, emphasizing the need for greater awareness and caution among companies operating in this space.
Thursday, October 3, 2024