Ethereum Foundation Uncovers 100 DPRK Crypto Operatives in Web3 Firms

Trade Now

This article was first published on The Bit Journal.

A security project supported by the Ethereum Foundation has found 100 DPRK crypto operatives posing as undercover employees at Web3 firms.

The finding was disclosed through the ETH Rangers program, a six-month funding initiative supporting independent security researchers, launched in late 2024. 

Through one of its funding initiatives, the Ketman Project tracked and identified these operatives and notified 53 crypto projects that they may have unknowingly employed them.

The Foundation elaborated in its official recap that this is one of the most acute operational security risks to Ethereum. As a result, this redirects the narrative from an observable external hack to something more difficult to detect which is the access from within.

How the Ketman Project Discovered DPRK Crypto Operatives

The Ketman Project did not rely on a single signal. Instead, it followed behaviors and inconsistencies that are associated with using fake identities across different systems.

According to findings published alongside the investigation, operatives were discovered through various patterns including reused avatars,  overlapping account metadata and mistakenly revealing unrelated email addresses during Screen Share sessions.

Another  repeated red flag involved mismatched system settings such as default language settings that did not match up with a developer’s stated nationality.

What made this glaring was not the tactics themselves, but how routine they appear. They formed  a consistent pattern throughout various organizations.

The project also created a publicly-available tool designed to report suspicious behaviours on GitHub, as well as collaborating with the Security Alliance in creating a framework for detecting similar hazards.

Why DPRK Crypto Operatives Are Moving Inside Web3 Companies

DPRK crypto operatives inside Web3 firms represent a new front in the evolution of North Korean strategy. Instead of only going in with high-value exploits, operatives are now earning legitimate positions within individual crypto companies to gain access over time. 

This allows them initial access to internal systems, codebases and financial infrastructure without alerting authorities immediately.

This method is consistent with more intelligence analyses. According to reports, North Korean IT workers were able to insert themselves into crypto and DeFi projects for years, often working across several platforms at once while pretending to be different entities.

In 2025 alone, North Korean-linked actors were tied to roughly $2 billion in stolen crypto, according to industry estimates cited in recent reporting.  By embedding workers inside firms, they reduce reliance on direct attacks in favor of long-term access points that can later be exploited.

From Smart Contract Risk to Human Vulnerability

For a long time, crypto security focused on code such as smart contract bugs (and exploits), bridge exploits and private key compromises.

But this investigation has revealed a different reality. The risk is now much more people-based than protocol-based.

Infiltration now occurs through hiring ways, where individuals simply integrate themselves into teams and earn trust before moving closer to privileged access.

This changes how one needs to manage risks. Someone who has legitimate access very frequently cannot be stopped by defenses like audits and bug bounties.

This also reveals a problem in Web3 and that is its reliance on  remote, pseudonymous collaboration. Although this openness allows great innovation, it also limits identity verification and tracking.

Industry Response Starts but Gaps Remain

That the Ethereum Foundation supports this investigation means the problem will be viewed seriously. The ETH Rangers program itself reported more outcomes beyond the DPRK findings including:

• More than 5.8 million dollars in funds recovered or frozen
• More than 785 vulnerabilities identified
• Dozens of incident responses handled

Those figures show that the effort did not just include tracking and identifying operatives but also strengthening the defenses throughout the network.

Still, challenges remain. Detection techniques are not completely disclosed, likely to prevent adversaries from adapting. Meanwhile, many projects are still susceptible to the same vulnerabilities as there are no standard hiring verification processes.

Conclusion

The exposure of DPRK crypto operatives working within Web3 companies and networks have changed the way security risks are understood across the sector. It is not only to protect against attacks from outside, the issue is not validating who has entered the system to begin with.

The investigation backed by the Ethereum Foundation has revealed that infiltration is already scaling and in many cases goes unnoticed until after access is gained.

The uncomfortable reality is that the greatest weakness might no longer be with the protocol itself; it may be right under the team’s roof.

Glossary

Web3: Blockchain-based decentralized internet infrastructure

GitHub: where you can host and collaboratively work on code

Smart Contract: Self-executing blockchain code

Insider Threat: The threat posed by a person who is within an organization

DeFi: Decentralized financial applications on blockchain

Frequently Asked Questions About DPRK Crypto Operatives

What are DPRK crypto operatives?

They are North Korean-associated persons employed in crypto companies under false identities.

How many were identified?

About 100 operatives across 53 Web3 projects.

Who uncovered them?

The Ethereum Foundation-backed Ketman Project.

Why is this dangerous?

Insiders have access to systems that outside hackers cannot get into.

Is this a new problem?

No, reports suggest this infiltration strategy has been ongoing for years.

References

Tradingview

Bitget

Ethereumblog

Cointribune

MEXC