By Ben Schiller Today, CoinDesk published a major scoop about how dozens of crypto companies have inadvertently hired programmers from North Korea. Reported and written by Sam Kessler, the investigation details how Pyongyang managed to infiltrate firms like Injective, ZeroLend, Fantom, Sushi, Yearn Finance and Cosmos Hub, raising millions of dollars that went toward North Korea’s nuclear weapons program. Hiring workers from North Korea is illegal, even when done so unwittingly. The practice also raises severe security risks, as North Korea has long worked to hack blockchain systems and funnel funds back home.
You should put 10 minutes on your calendar to read through the whole piece, because it contains lots of juicy information. But in case you don’t have 10 minutes, here are some quick takeaways. It’s a bigger problem than you think: "The percentage of your incoming resumes, or people asking for jobs, or wanting to contribute – any of that stuff – that are probably from North Korea is greater than 50% across the entire crypto industry," Zaki Manian, a prominent blockchain developer who says he inadvertently hired two DPRK IT workers to help develop the Cosmos Hub blockchain in 2021, told Kessler. "Everyone is struggling to filter out these people."
It’s not a new problem: Sources interviewed by Kessler said North Korean programmers were applying for crypto jobs as far back as 2016. But, until recently, the companies targeted have refrained from revealing what had happened or didn’t know it was happening.
“Previously, employers remained silent due to concerns about unwanted publicity or legal repercussions. Now, confronted with extensive payment records and other evidence unearthed by CoinDesk, many of them have decided to come forward and share their stories for the first time, exposing the overwhelming success and scale of North Korea’s efforts to penetrate the crypto industry,” Kessler writes. Moreover, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC), which oversees U.S. sanctions enforcement, has been drawing greater attention to the problem.
The workers didn’t enjoy the fruits of their labor: Several companies who hired North Korean coders told CoinDesk that the workers did a good job. But they were effectively slave labor. Most of the money earned went back to the North Korean regime. It’s "bad because you're paying people that are basically being exploited by the regime," MetaMask's Taylor Monahan told Kessler. "If I am paying someone and they're literally being forced to send their entire paycheck to their boss, that would make me very uncomfortable. It would make me more uncomfortable if their boss is, you know, the North Korean regime." Companies didn’t realize their employees could be hackers: Many of the companies involved had suspicions about the workers they hired. Their IDs didn’t check out, or certain cultural details didn’t align with what the employees had stated about their backgrounds or locations. But the companies didn’t realize they were running security risks. “Many of the employers consulted by CoinDesk were under the mistaken impression that DPRK IT workers operate independently from North Korea's hacking arm, but blockchain data and conversations with experts reveal that the regime's hacking activities and IT workers are frequently linked,” Kessler says. “In September 2021, MISO, a platform built by [SushiSwap] for launching crypto tokens, lost $3 million in a widely reported heist. CoinDesk found evidence that the attack was linked to Sushi’s hiring of two developers with blockchain payment records connected to North Korea.” The hacks aren’t Hollywood: North Korea is estimated by Chainalysis to have stolen roughly $1.5 billion in crypto in the past seven years. But the attacks, according to Kessler, “don't tend to resemble the Hollywood version of hacking, where hoodie-wearing programmers break into mainframes using sophisticated computer code and black-and-green computer terminals. They usually involve some version of social engineering, where the attacker earns the trust of a victim who holds the keys to a system and then extracts those keys directly through something as simple as a malicious email link." "To date, we have never seen DPRK do, like, a real exploit," said Monahan. "It's always: social engineering, and then compromise the device, and then compromise the private keys." Read the whole story here. |
