North Korean IT workers operated within DeFi protocols for years, researcher warns

cryptonews04-06 16:45

North Korean-linked operators have spent years quietly integrating into crypto firms and DeFi teams, raising fresh concerns about insider risk after a string of high-value exploits tied to the country...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2625767896?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-04-06 16:45","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2625767896","market":"us","top_or_hot":-1,"title":"North Korean IT workers operated within DeFi protocols for years, researcher warns","media":"cryptonews","content":"<div>\n<p>North Korean-linked operators have spent years quietly integrating into crypto firms and DeFi teams, raising fresh concerns about insider risk after a string of high-value exploits tied to the country...</p>\n\n<a href=\"https://crypto.news/north-korean-it-workers-operated-within-defi-protocols-for-years-researcher-warns/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>North Korean IT workers operated within DeFi protocols for years, researcher warns</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nNorth Korean IT workers operated within DeFi protocols for years, researcher warns\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-04-06 16:45 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/north-korean-it-workers-operated-within-defi-protocols-for-years-researcher-warns/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>North Korean-linked operators have spent years quietly integrating into crypto firms and DeFi teams, raising fresh concerns about insider risk after a string of high-value exploits tied to the country...</p>\n\n<a href=\"https://crypto.news/north-korean-it-workers-operated-within-defi-protocols-for-years-researcher-warns/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BK4585","symbol_name":"ETF&股票定投概念","start_time":0,"source_url":"https://crypto.news/north-korean-it-workers-operated-within-defi-protocols-for-years-researcher-warns/","article_id":"2625767896","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/north-korean-it-workers-operated-within-defi-protocols-for-years-researcher-warns/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2625767896","pubTimestamp":1775465132,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"North Korean-linked operators have spent years quietly integrating into crypto firms and DeFi teams, raising fresh concerns about insider risk after a string of high-value exploits tied to the country’s cyber apparatus.North Korean-linked developers have worked inside more than 40 DeFi projects over the past seven years, according to a security researcher.Security researcher and MetaMask developer Taylor Monahan said these tactics stretch back to the early days of decentralized finance, with individuals tied to the Democratic People’s Republic of Korea contributing to several widely used protocols.“Lots of DPRK IT workers built the protocols you know and love, all the way back to DeFi summer,” she said on Sunday, adding that more than 40 platforms, including several well-known projects, have at some point relied on such developers.However, she noted that the “seven years of blockchain dev experience” listed on their resumes is “not a lie.”“Basic and in no way sophisticated […] the only","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BK4585":"ETF&股票定投概念","BK4588":"碎股","VGT":"信息技术ETF-Vanguard"},"translate_title":"研究人员警告称，朝鲜IT员工多年来一直在DeFi协议内运营","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"VGT":1.5},"content_text":"North Korean-linked operators have spent years quietly integrating into crypto firms and DeFi teams, raising fresh concerns about insider risk after a string of high-value exploits tied to the country’s cyber apparatus.\n\n\nSummary\n\n\n\nNorth Korean-linked developers have worked inside more than 40 DeFi projects over the past seven years, according to a security researcher.\nInvestigators and industry participants warn that many infiltration attempts rely on simple but persistent tactics through hiring channels and social engineering.\n\n\n\nSecurity researcher and MetaMask developer Taylor Monahan said these tactics stretch back to the early days of decentralized finance, with individuals tied to the Democratic People’s Republic of Korea contributing to several widely used protocols. \n“Lots of DPRK IT workers built the protocols you know and love, all the way back to DeFi summer,” she said on Sunday, adding that more than 40 platforms, including several well-known projects, have at some point relied on such developers.\nHowever, she noted that the “seven years of blockchain dev experience” listed on their resumes is “not a lie.”\nInvestigators have long tied North Korea’s cyber operations to the Lazarus Group, a state-backed collective believed to have stolen around $7 billion in digital assets since 2017, according to R3ACH analysts. \nThe group has been associated with some of the industry’s largest breaches, including the $625 million Ronin Bridge exploit in 2022, the $235 million WazirX hack in 2024, and the $1.4 billion Bybit incident in 2025.\nNorth Korean actors behind Drift exploit\nLast week’s $280 million exploit of Drift Protocol has drawn renewed scrutiny. The project said it had “medium-high confidence” that a North Korean state-affiliated group was behind the attack, linking the incident to a wider pattern of infiltration and social engineering.\nHowever, the face-to-face meetings that led up to the breach were not with North Korean nationals, but rather “third party intermediaries” using “fully constructed identities including employment histories, public facing credentials, and professional networks.”\nThese profiles included employment histories, public credentials, and active professional networks, allowing them to build trust through in-person interactions before the exploit unfolded.\nIndependent blockchain investigator ZachXBT has warned in a recent X post that not all threats tied to North Korea operate at the same level of sophistication.\n“The main issue is that everyone groups them all together when the complexity of threats is different,” he said.\nHe described many infiltration attempts as relatively simple, relying on persistence rather than technical complexity. Outreach through job postings, LinkedIn, email, Zoom calls, and interview processes remains common. \n“Basic and in no way sophisticated […] the only thing about it is they’re relentless,” he said, adding that teams continuing to fall for such tactics in 2026 risk being seen as negligent.\n\n\n\n\n\n                Read more:\n            \n\n                Rwanda central bank warns against crypto use after Bybit adds franc support","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":null,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.39.0","shortVersion":"4.39.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2625767896","isCrawlerRequest":true}