North Korea’s crypto crime operations have evolved beyond traditional hacking: new data reveals coordinated infiltration campaigns targeting Web3 companies through legitimate recruitment channels, with operatives now hiring European proxies to pass initial interviews.
The Scale of Infiltration
The scale is staggering: North Korean actors stole $1.34 billion in 2024 (61% of all crypto thefts), including the record-breaking $1.5 billion Bybit heist. But the shift from external attacks to insider threats represents a fundamental change in attack vectors.
Recent cases show operatives managing 12+ false identities simultaneously, using AI-powered interview assistance and voice modulation to evade detection. Once hired, they alter smart contracts, exfiltrate private keys, and drain wallets from within.
The Human Factor
The human factor proves critical: companies report candidates switching accents between interviews, screen recordings revealing Korean interfaces during coding tests, and sophisticated backstories that crumble under cultural knowledge tests.
Fraser Edwards, CEO of Cheqd, noted that candidates would sound European on the first call before switching to someone sounding like they were from Asia – Cheqd detected five infiltration attempts using this pattern.
Regulatory Response
The US Treasury’s latest sanctions target this infrastructure directly, freezing assets of Russian facilitators employing North Korean IT workers and dismantling networks that enabled these operations. But with operatives using GenAI tools, stolen identities, and shell companies across multiple jurisdictions, the challenge for investigators continues to escalate.
Further reading:
New Investigative Approaches Required
This evolution demands investigative approaches that combine behavioral analysis, linguistic forensics, and human intelligence gathering. The convergence of state-sponsored infiltration and AI-enabled fraud requires methodologies that can trace both digital footprints and human deception patterns.
