How North Korean Crypto Hackers Infiltrate Startups Easily

Key Points

• North Korean crypto hackers use fake IT job applications to breach Web3 firms
• ZachXBT reveals organized tactics and identities behind recent attacks
• Teams operate with over 30 fake profiles using government IDs and VPNs
• Most startups fail due to weak vetting and poor security awareness

In a new and alarming investigation, renowned crypto sleuth ZachXBT has revealed how North Korean crypto hackers are infiltrating Web3 startups with fake identities.

1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects. pic.twitter.com/DEMv0GNM79

— ZachXBT (@zachxbt) August 13, 2025

His newly published documents detail how these actors, mainly linked to the infamous Lazarus Group, disguise themselves as remote workers, particularly in IT and security roles, to gain insider access.

Once inside, they quietly scan for vulnerabilities, pass the information to other teams, and vanish before anyone suspects a thing. The scale is stunning, and so is the negligence enabling it.

North Korean Job Search Roster. Source: ZachXBT – Techtoken

This revelation couldn’t come at a more sensitive time. The crypto industry is undergoing rapid growth, with massive capital investments like Pantera’s recent $300M injection into crypto treasury firms (read more).

As funding flows in, so does the attention of global cybercrime syndicates, including those backed by nation-states like North Korea.

1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects. pic.twitter.com/DEMv0GNM79

— ZachXBT (@zachxbt) August 13, 2025

Inside the Hack: How the Infiltration Works

ZachXBT’s report reveals that these North Korean crypto hackers operate in five-person teams, each managing around 30+ fake identities. They go to great lengths to appear legitimate:

• Buying realistic government-issued IDs

• Creating verified LinkedIn and Upwork accounts

• Using premium VPN services to mask their origins

• Presenting professionally written resumes with fake experience

Once they secure a job in a Web3 startup, they begin looking for exploitable code, misconfigured smart contracts, or weak internal tools.

10/ Still one of the more common questions is “how do you know they are North Korean?”

Well besides all of the fraudulent documents detailed above their search history showed frequent Google Translate usage with translations to Korean with a Russian IP. pic.twitter.com/wtTgzaiNcy

— ZachXBT (@zachxbt) August 13, 2025

This tactic has become increasingly common, particularly in DeFi, wallet tech, and cross-chain bridges, all sectors booming during the anticipated 2025 crypto bull run.

But there’s a disturbing twist: These hackers don’t act alone. After gathering internal data, they pass it on to another group, often part of Lazarus, that executes the hack, launders the funds, and moves on. The original job applicant simply disappears or resigns, leaving no trace.

“The hackers aren’t super advanced, they’re just persistent and well-practiced,” ZachXBT says. “The real weakness is arrogance from teams who think they can’t be fooled.”

Why Startups Keep Falling for the Trap

So how are these fake applicants slipping through the cracks? The answer lies in a pattern of negligence, poor vetting, and denial.

ZachXBT highlights a major issue: security warnings are often ignored. Even when cybersecurity experts raise red flags, some startups dismiss them outright, refusing to believe their team could be compromised.

This attitude is dangerous, especially with how easily these hackers blend in. Here are some red flags often ignored:

• Inconsistent communication patterns

• Too-similar resumes across applicants

• Use of the same few VPNs

• Profiles with no digital history before 2023

This is particularly concerning for teams building on high-volume blockchains like XRP, which has seen whale activity surge around escrow moves, and Stellar (XLM), now attracting new developer talent as price action heats up.

Hackers target these ecosystems, knowing money and attention are flowing in, making them high-reward environments.

11/ The main challenge faced in fighting DPRK ITWs at companies include the lack of collaboration between services and the private sector.

There’s also the negligence by the teams hiring them who become combative when alerted.

ITWs are in no way sophisticated but are… pic.twitter.com/6BJDfsWGEd

— ZachXBT (@zachxbt) August 13, 2025

Combatting the Infiltration: Prevention Tactics for Web3 Teams

The good news? These attacks can be stopped if startups take basic precautions seriously.

ZachXBT outlines a few preventative steps every Web3 project should follow:

1. Thorough background checks — Go beyond resumes. Look for inconsistencies across platforms and ask for verifiable references.

2. Monitor VPN activity — Be wary of employees using uncommon or foreign-based VPNs during working hours.

3. Flag pattern similarities — Multiple applicants using the same work samples or job history might be linked.

4. Establish a zero-trust culture — Treat every access request and role with scrutiny, especially in remote-first teams.

Projects also need to foster open communication with cybersecurity professionals, rather than treating them as adversaries. Ignoring a credible warning can cost millions and your reputation.

Just ask Bybit, which suffered a devastating hack earlier this year, believed to be orchestrated by a similar group of infiltrators.

A Wake-Up Call for the Crypto Industry

The crypto space is evolving fast, with promising growth from Layer-1 chains like NEAR Protocol, now attracting over 3 million active users and bullish price forecasts. As innovation accelerates, so does the risk.

North Korean crypto hackers don’t just steal, they destabilize the very trust the ecosystem relies on.

In an industry still recovering from high-profile collapses and legal battles, like those shaping the Trump crypto enforcement narrative, this is the last thing Web3 needs.

Startups must understand: The enemy doesn’t always knock. Sometimes, they enter with a smile, a fake resume, and a solid understanding of your GitHub.