Investigation into the Infiltration of North Korean IT Workers in the Crypto Assets Industry

The phenomenon of cryptocurrency companies inadvertently hiring North Korean IT workers is more common than imagined. Several well-known blockchain projects such as Cosmos Hub, Injective, ZeroLend, Fantom, Sushi, and Yearn Finance have unknowingly employed North Korean IT staff. These employees successfully passed interviews and background checks using false identities and provided seemingly real work experiences.

In countries like the United States that sanction North Korea, hiring North Korean workers is illegal. This also poses security risks, as several companies have faced hacking attacks after employing North Korean IT workers. Notable blockchain developer Zaki Manian stated: "Everyone is working hard to filter out these individuals." He himself inadvertently hired two North Korean IT workers in 2021 to help develop the Cosmos Hub blockchain.

The infiltration methods of North Korean IT workers include:

1. Use carefully forged documents and resumes to pass the company's background check.

2. Showcase an impressive code contribution history on platforms like GitHub.

3. Turn off the webcam, as sometimes multiple people impersonate one employee.

4. The working hours do not match the claimed location.

5. Frequently changing payment addresses and online identities.

Many companies have stated that the work abilities of North Korean employees vary greatly. Some have simply "scammed a few months' wages," while others have strong technical skills.

Employers often realize some abnormal signs only afterwards, such as inconsistent accents of employees, strange background noises, etc. However, due to the prevalence of remote work, these signs did not raise any alarm at the time.

In addition to legal risks, employing North Korean IT workers also raises ethical issues. Reports indicate that they can only retain 10-30% of their wages, with the remainder going to the government.

Several companies that have been attacked by hackers found that the attacks were related to North Korean IT workers previously hired. In 2021, the Sushi platform MISO was hacked for $3 million, which was linked to two North Korean developers.

Overall, North Korean IT workers have deeply infiltrated the Crypto Assets industry, posing legal and security risks to companies. Crypto companies need to remain vigilant and strengthen background checks to prevent inadvertently hiring North Korean employees.