Researchers Expose North Korean IT Worker Infiltration Scheme via Fake DeFi Startup Sting

NewsData.io · United States · Aug 11, 2026

Cybersecurity researchers from BCA LTD, NorthScan, and ANY.RUN set up a fictitious cryptocurrency startup to lure and document North Korean (DPRK) IT workers linked to the Lazarus Group's Famous Chollima unit, successfully hiring three operatives using forged identities, fake credentials, and mule bank accounts. The operation provides an inside view of how DPRK workers use fabricated résumés, proxy interviews, AI translation tools, and remote facilitators to gain legitimate employment at Western companies — particularly in crypto, finance, and healthcare. Once hired, these operatives seek sustained access to source code, intellectual property, and internal systems while routing salaries back to the regime. The findings are a direct warning to staffing agencies and hiring managers: standard background checks and ID verification are insufficient against sophisticated nation-state actors targeting remote tech roles.