A small group of North Korean IT workers has been linked to a $680,000 crypto theft in June \u2014 and leaked screenshots reveal how they\u2019ve been blending in with legitimate developers to infiltrate projects, according to Cointelegraph<\/a><\/em>.<\/p>\n The images, shared on X by blockchain investigator ZachXBT, came from an unnamed source who managed to access one of the workers\u2019 devices. They offer a rare look into the methods used by hackers tied to North Korea\u2019s state-backed operations.<\/p>\n The group appears to be made up of just six people, but they control at least 31 false identities. These include forged government IDs, phone numbers, and purchased LinkedIn and Upwork accounts. Using these identities, they have applied for developer roles in crypto and blockchain projects.<\/p>\n Evidence suggests one of the workers interviewed for a full-stack engineer position at Polygon Labs. In other cases, they prepared scripted interview answers, claiming past work for companies like OpenSea and Chainlink to gain credibility.<\/p>\n Once hired, they often worked remotely through platforms like Upwork, using AnyDesk for access to company systems and VPNs to hide their locations. Screenshots also showed they used Google Drive, Chrome profiles, and the company\u2019s Korean-to-English translation tool to manage schedules and communicate in English.<\/p>\n A spreadsheet found on one device listed $1,489.80 in expenses for May, detailing the costs of their ongoing operations.<\/p>\n One Payoneer account linked to the group converted fiat into crypto, with activity traced to a wallet address \u2014 \u201c0x78e1a\u201d \u2014 that investigators say was tied to the June 2025 hack of fan-token marketplace Favrr. That attack drained about $680,000.<\/p>\n ZachXBT previously alleged that Favrr\u2019s chief technology officer, known as \u201cAlex Hong,\u201d and some other developers were in fact North Korean workers using false identities.<\/p>\n The group\u2019s online activity also revealed their research interests, from asking if ERC-20 tokens could run on Solana to searching for AI development companies in Europe.<\/p>\n North Korean-linked teams have been behind some of the largest crypto thefts on record, including a $1.4 billion exploit of the exchange Bitbit earlier this year. Over time, they\u2019ve taken millions from protocols by posing as contractors and remote workers.<\/p>\n Their tactics aren\u2019t always complex, but they work in volume \u2014 sending out enough applications that some inevitably slip through. Once inside, they can quietly gather data, siphon funds, or lay the groundwork for future attacks.<\/p>\n ZachXBT says crypto and tech firms need to be more thorough in screening hires. \u201cMany of these operations aren\u2019t highly sophisticated,\u201d he said, \u201cbut the sheer number of applications means hiring teams sometimes overlook red flags.\u201d<\/p>\n He added that a lack of cooperation between tech companies and freelance platforms makes it easier for such groups to stay active.<\/p>\n The US Treasury has already taken action, sanctioning two people and four companies linked to a similar North Korean IT worker network in July. The move reflects growing concern over how state-backed cyber teams are targeting private companies \u2014 often hiding in plain sight.<\/p>\n (Photo by Mika Baumeister<\/a>)<\/em><\/p>\n See also: Cryptocurrency adoption patterns revealed in two studies<\/a><\/strong><\/p>\nFake identities and hidden work<\/h3>\n
Connection to the Favrr hack<\/h3>\n
Past and ongoing operations<\/h3>\n
Call for tighter checks<\/h3>\n
![\"\"\/](\"https:\/\/blockchaintechnology-news.com\/wp-content\/uploads\/2022\/12\/blockchain-expo-world-728-x-90-01.png\")