Investigation Reveals: 21 North Korean Crypto Developers Make $500K Monthly

user avatar

by Giorgi Kostiuk

2 years ago

Made with AI

  1. Detected Developer Network
  2. Theft of $1.3 Million and Money Laundering
  3. Connection to Sanctioned Individuals and Organizations


    4. Blockchain investigator ZachXBT has uncovered a network of North Korean developers working on various crypto projects and earning up to $500,000 per month.

    Detected Developer Network

    In a post on the social network X, dated August 15, ZachXBT informed his followers that an organization in Asia, likely operating out of North Korea, is receiving $300,000 to $500,000 per month employing at least 21 developers for over 25 crypto projects. To support this claim, the investigator published a screenshot with examples of identified transactions.

    Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed.

    Theft of $1.3 Million and Money Laundering

    ZachXBT alleges this latest $1.3 million stolen by North Korean workers was laundered through a sequence of transactions, including transferring to a theft address and ending with 16.5 Ether (ETH) going to two different exchanges. Further investigation revealed that these developers are part of a much more extensive network.

    Connection to Sanctioned Individuals and Organizations

    ZachXBT discovered that the payment addresses are linked to Sim Hyon Sop, who was sanctioned by the Office of Foreign Assets Control (OFAC) for coordinating financial transfers that ultimately supported North Korean weapons programs. Additionally, the investigator found addresses connected to another sanctioned individual, Sang Man Kim, involved in North Korean-related cybercrime. Some developers even inadvertently revealed their other identities in notes.

    An anonymous group of developers with Russian telecom IP addresses claimed to be based in the USA and Malaysia. At least one of them accidentally leaked their other identities on a notepad.

    The investigation revealed that organizations linked to North Korea are involved in cyberattacks and other fraudulent schemes to generate income, which is then sent back to the country. Many of these workers were hired through recruitment agencies and referred each other. The US Departments of Justice, State, and Treasury have previously warned about the influx of North Korean workers into the crypto and IT industries, working remotely for various projects.

Tier I

Sector: #18291

Sealed Hiding Place Room

Resource Cache

Resource Cache

Tier I

Requires 25% Tier Progress to Claim
Meme Cache

Meme Cache

Tier I

Requires 50% Tier Progress to Claim
Equipment Cache

Equipment Cache

Tier I

Requires 75% Tier Progress to Claim

After collecting, hiding places will be stored in your inventory and can be opened with Keys.

Other news

SEC Updates Cryptoassets FAQ with New Governance Questions

On November 2, 2026, the SEC Division of Corporation Finance added new questions to its cryptoassets FAQ, addressing governance through foundations and organizations, control over participation, and the distinction between functional and decentralized networks.

user avatarDiego Alvarez

Chainalysis Reports Security Incident Affecting Customer Data

Chainalysis reported a security incident on October 30 that impacted a subset of customer-related information, including names and email addresses.

user avatarKenji Takahashi

Hong Kong Launches Postquantum Cryptography Toolkit

On November 2, the Hong Kong Monetary Authority and the Hong Kong University of Science and Technology launched a postquantum cryptography assessment toolkit to help banks identify necessary upgrades to their cryptographic systems as quantum computing evolves.

user avatarMaria Fernandez

NYSE Partners with Major Firms for Tokenized Securities Initiative

On November 2, the New York Stock Exchange announced partnerships with Broadridge, Computershare, Equiniti, and Superstate to support a proposed tokenized securities venue aimed at enhancing infrastructure and improving market operations.

user avatarGustavo Mendoza

BTCPay Servers 247 Release Addresses Security Vulnerabilities

The latest release of BTCPay Servers, version 247, includes critical security fixes to enhance security for businesses operating their own Bitcoin payment servers.

user avatarRajesh Kumar

Aave Freezes tBTC Supply and Borrowing Amid Threshold's Pause

Aave contributors announced a freeze on additional tBTC supply and borrowing in its Ethereum Core market following Threshold's temporary pause of the token's mint and redeem functions.

user avatarMiguel Rodriguez

Important disclaimer: The information presented on the Dapp.Expert portal is intended solely for informational purposes and does not constitute an investment recommendation or a guide to action in the field of cryptocurrencies. The Dapp.Expert team is not responsible for any potential losses or missed profits associated with the use of materials published on the site. Before making investment decisions in cryptocurrencies, we recommend consulting a qualified financial advisor.