cryptd.in

另类 LinkedIn 适合加密人才

Google Docs, Upwork, and LinkedIn: Inside North Korean IT Workers’ Secret Crypto Operations

-

由

cryptd.in
于

Investigations by popular blockchain sleuth ZachXBT have uncovered extensive North Korean infiltration in the global cryptocurrency development job market.

An unnamed source recently compromised a device belonging to a DPRK IT worker and provided unprecedented insight into how a small team of five IT workers operated over 30 fake identities.

DPRK Operatives Flood Crypto Job Market

According to ZachXBT’s tweets, the DPRK team reportedly used government-issued IDs to register accounts on Upwork and LinkedIn, to obtain developer roles on multiple projects. Investigators found an export of the workers’ Google Drive, Chrome profiles, and screenshots, which revealed that Google products were central to organizing schedules, tasks, and budgets, with communications primarily conducted in English.

Among the documents is a 2025 spreadsheet containing weekly reports from team members, which shed light on their internal operations and mindset. Typical entries included statements such as “I can’t understand the job requirement, and don’t know what I need to do,” with self-directed notes like “Solution / fix: Put enough efforts in heart.”

Another spreadsheet tracks expenses, showing purchases of Social Security numbers, Upwork and LinkedIn accounts, phone numbers, AI subscriptions, computer rentals, and VPN or proxy services. Meeting schedules and scripts for fake identities, including one under the name “Henry Zhang,” were also recovered.

The team’s operational methods reportedly involved purchasing or renting computers, using AnyDesk to perform work remotely, and converting earned fiat into cryptocurrency via Payoneer. One wallet address, 0x78e1, associated with the group is linked on-chain to a $680,000 exploit at Favrr in June 2025, where the project’s CTO and other developers were later identified as DPRK IT workers using fraudulent documents. Additional DPRK-linked workers were connected to projects via the 0x78e1 address.

Indicators of their North Korean origin include frequent use of Google Translate for Korean-language searches conducted from Russian IP addresses. ZachXBT said that these IT workers are not particularly sophisticated, but their persistence is bolstered by the sheer number of roles they target across the world.

Challenges in countering these operations include poor collaboration between private companies and services, as well as resistance from teams when fraudulent activity is reported.

North Korea’s Persistent Threat

North Korean hackers, notably the Lazarus Group, continue to pose a significant threat to the industry. In February 2025, the group orchestrated the largest crypto exchange hack in history, as it stole approximately $1.5 billion in Ethereum from Dubai-based Bybit.

The attack exploited vulnerabilities in a third-party wallet provider, Safe{Wallet}, which allowed the hackers to bypass multi-signature security measures and siphon funds into multiple wallets. The FBI attributed the breach to North Korean operatives, labeling it “TraderTraitor”.

Subsequently, in July 2025, CoinDCX, an Indian cryptocurrency exchange, fell victim to a $44 million heist, which was also linked to the Lazarus Group. The attackers infiltrated CoinDCX’s liquidity infrastructure, exploiting exposed internal credentials to execute the theft.

职位 Google Docs, Upwork, and LinkedIn: Inside North Korean IT Workers’ Secret Crypto Operations 首次出现在 加密土豆.

评论

發佈留言

發佈留言必須填寫的電子郵件地址不會公開。 必填欄位標示為 *

最新信息

热门类别

zh_TW 繁體中文
zh_TW 繁體中文 en_US English ro_RO Română et Eesti ko_KR 한국어 ja 日本語 ru_RU Русский de_DE Deutsch es_ES Español zh_CN 简体中文 fr_FR Français pt_PT Português it_IT Italiano pl_PL Polski tr_TR Türkçe nl_NL Nederlands id_ID Bahasa Indonesia el Ελληνικά uk Українська bg_BG Български cs_CZ Čeština fi Suomi hu_HU Magyar lv Latviešu valoda lt_LT Lietuvių kalba nb_NO Norsk bokmål sk_SK Slovenčina sl_SI Slovenščina sv_SE Svenska

搜索网站

热门故事

标签

#AlexeyPertsev (1) #BidenCryptoBan (1) #BidenElection (1) #BinanceVsCoinbase (1) #Bitcoin (458) #BitcoinETF (3) #itcoinFundamentals (1) # 比特币处理 (1) # 比特币价格 (5) # 比特币价格水平 (1) #BitcoinPump (1) #BitcoinReserve (1) #BitcoinSurge (1) #itcoinTop (1) #Bitfinex (1) #Bitwise (1) #BracebridgeCapital (1) #BRC20Tokens (1) #BTC 收购 (1) 1TP5 看涨预测 (1) #BullishSentiment (1) #C 中国矿业 (1) #CPIPreview (1) #CryptoAsset (2) #CryptoBattle (1) #CryptoBoom (1) #CryptoExpert (1) #CryptoInsights (1) #CryptoMania (1) #CryptoMarket (4) #CryptoPrediction (1) #CryptoPredictions (1) #CryptoRegulation (2) #CryptoTakeoff (1) #CryptoTiming (1) #CryptoTips (1) #CryptoTreasury (1) #CryptoUncertainty (1) #DerivativeJump (1) #Dogecoin (74) #ogecoinGains (1) #ogecoinVolume (1) #DutchCourt (2) #ECommerce (1) #El萨尔瓦多比特币 (1) #E以太坊 (74) #EthereumPain (1) #E以太坊价格 (1) #ExpertOpinion (1) #FedRateCut (1) #FiatCurrency (1) #F 财务影响 (1) #F 财务隐私 (1) #FirmShutdown (1) #FrozenAccounts (1) #IllicitFunds (1) #InflationData (1) #Investment (1) #InvestmentLoss (1) #JapaneseFirm (1) #L LegalAction (1) #L 法律影响 (1) #Legislation (1) #LightningNetwork (1) #M 市场分析 (3) #M 市场监测 (1) #M 市场预测 (1) #M 市场预测 (1) #M 市场投影 (1) #M 市场支持 (1) #M 市场波动性 (1) #M 婚姻 (1) #MemeCoin (5) #MemeCoins (2) #Miner 盈利能力 (1) #M 洗钱 (2) #MtGox (4) #朝鲜加密货币 (1) #诺沃格拉茨预测 (1) 1TP5价格里程碑 (1) #P 价格预测 (2) 1TP5价格问题 (1) #PriceSurge (1) #PrisonSentence (1) # 量化分析 (1) #R 监管压力 (1) #SECA Anti-Crypto (1) #ShibaInu (6) #SocialBuzz (1) #T 技术分析 (1) #Toncoin (3) #T 龙卷风现金 (3) #T 龙卷风现金发展项目 (1) #T 龙卷风现金开发者 (1) #UKCrypto (1) #UpsidePotential (1) #USCongress (1) #WyomingLand (1) #XRPPrice (1) #XRPupswing (1)

实用链接

我发现了一些有用的链接，希望与大家分享。