An investigation by data analyst ZachXBT revealed substantial payments to North Korean IT workers through fake job placements in the cryptocurrency sector and beyond.
Discovery of Payments to North Korean IT Workers
The investigation revealed that since January 1, 2025, $16.58 million had been paid to North Korean IT workers via cryptocurrency, averaging $2.76 million per month. Payment amounts ranged from $3,000 to $8,000 per month per worker, suggesting between 345 and 920 jobs.
Methods of Systematic Infiltration
ZachXBT identified multiple red flags indicating North Korean IT workers, including refusal to meet in person, irregular LinkedIn activity, and suspicious IP addresses. These indicators suggest organized groups deliberately undermining security at tech companies.
Impact on Cryptocurrency Markets
As North Korean IT workers open accounts on platforms like Coinbase and Robinhood, their activity has significantly shifted perceptions of security in the cryptocurrency space. North Korean-linked hacking groups stole about $2.1 billion in cryptocurrency during the first half of 2025, including the largest theft of $1.5 billion associated with the Bybit exchange.
The investigation highlights serious cybersecurity issues in both the cryptocurrency industry and traditional technology sectors, finding evidence of systematic exploitation of remote work opportunities.
