Home
Cryptocurrency
Cryptocurrency News
Blockchain Sleuth Claims DPRK Unit Made $1 Million a Month Posing as Crypto IT Workers

Blockchain Sleuth Claims DPRK Unit Made $1 Million a Month Posing as Crypto IT Workers

Investigation reveals organised crypto fraud using fake IT identities.

Written by Rahul Dhingra, Edited by David Delima | Updated: 9 April 2026 16:01 IST

Blockchain Sleuth Claims DPRK Unit Made $1 Million a Month Posing as Crypto IT Workers

Photo Credit: Unsplash/lonely blue

Fraud network used job roles and crypto platforms to generate revenue

Click Here to Add Gadgets360 As A Trusted Source

Highlights

Hackers used fake identities to secure remote IT jobs
Shared platform tracked earnings and crypto transactions
Funds routed through payment platforms to bank accounts

A North Korean hacker unit made more than $3.5 million (roughly Rs. 3.25 crore) working as impostors through various IT jobs. This group was faking their identities and were hacking multiple crypto projects and earning around $1 million a month (roughly Rs. 93 lakh), as per documents obtained by blockchain sleuth ZachXBT via an unnamed source. The North Korean unit also forged legal documents and crypto-to-fiat conversions. This unnamed source further revealed that a DPRK IT worker called ‘Jerry' had their device compromised via infostealer, wherein the source further extracted data included IPMsg chat logs, fake identities, and browser history.

Fake IT Roles and Coordinated Platforms Used in Crypto Fraud

The DPRK hackers were coordinating through a website called “luckyguys.site”, using a shared password which was “123456”. The post shared by ZachXBT also revealed that some of the users on the fraudulent platform appeared to work for Sobaeksu, Saenal and Songkwang, which are sanctioned by the US Office of Foreign Assets Control. The aforementioned crypto payments were converted into fiat and then sent to Chinese bank accounts through online payment platforms such as Payoneer. It was also discovered that the hackers were using a Discord-style messaging system to report their payments back to their handlers.

1/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions.

I spent long hours going through all of it, none of which has ever been publicly released.

It revealed an intricate… pic.twitter.com/aTybOrwMHq
— ZachXBT (@zachxbt) April 8, 2026

The North Korean IT workers also maintained a leaderboard on this platform, which exposed how much business each crypto IT worker had brought in the organisation since December 8, 2025, with links to blockchain explorer pages showing transaction details. ZachXBT also exposed that the IT worker named Jerry also applied for various job roles, which include one in Texas and an unsent email, applying for a WordPress content and search engine optimisation role at a T-shirt company in Texas.

8/ Jerry's compromised device shows usage of Astrill VPN and various fake personas applying for jobs.

An internal Slack showed 'Nami' sharing a blog post about a DPRK IT worker deepfake job applicant. A second user asked if it was them, while a third noted they aren't allowed to… pic.twitter.com/7ZdGbX91WT
— ZachXBT (@zachxbt) April 8, 2026

The IT workers also falsified their identities, as one of the IT workers, ‘Rascal' shared pictures of a billing statement using a fake name and fake address in Hong Kong. Rascal also shared a picture of an Irish passport, though it is not clear if it was used.

4/ Here is one of the WebMsg users 'Rascal' and their DMs with PC-1234 detailing payment transfers and the use of fraudulent identities from December 2025 through April 2026.

All payments are processed and confirmed through the server admin account: PC-1234.

Addresses in Hong… pic.twitter.com/akyjmTbL5J
— ZachXBT (@zachxbt) April 8, 2026

The North Korean IT workers group were also in the spotlight earlier this year, when data by Security researcher Taylor Manonan had claimed that North Korean IT workers have been infiltrating DeFi platforms for the past 7 years and stolen over $7 billion (roughly Rs. 65,000 crore) in crypto since 2017. The infamous Drift Protocol hack of $285 million (roughly Rs. 2,600 crore) was also pinned on one of the DPRK units.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Cryptocurrency, Crypto Scams, Crypto Regulations

Rahul Dhingra

Email Rahul Dhingra

Rahul Dhingra is a crypto writer at Gadgets 360, where he covers the exciting world of Cryptocurrency, Blockchain, Defi and Web3. Before joining Gadgets 360, he worked as a content specialist for a European-based Crypto Exchange. Rahul loves storytelling, not just through the written word but also through the visual medium. Beyond his professional life, Rahul is a sports fanatic. Whether it’s cricket or football, his passion for the game is contagious. More