The DPRK’s Deep Roots in Crypto

Last week, CoinDesk’s Sam Kessler reported that developers and IT workers employed by the Democratic People’s Republic of Korea – i.e. North Korea – had managed to get themselves hired by a number of crypto projects, giving them two different ways of raising funds for the national regime.

You’re reading State of Crypto, a CoinDesk newsletter looking at the intersection of cryptocurrency and government. Click here to sign up for future editions.

DPRK IT workers

The narrative

CoinDesk reporter Sam Kessler found that more than a dozen different crypto companies and projects – including some well-known ones – inadvertently hired developers and IT workers from the Democratic People’s Republic of Korea (aka North Korea), something that’s troubling on a number of levels for these projects.

Why it matters

North Korea is under heavy sanctions, meaning hiring developers from the country would put a project in violation of U.S. law. It also seems clear that some of these employees enabled the projects they worked for to be hacked.

Breaking it down

North Korean employees working for U.S. companies isn’t a new problem. In July, cybersecurity firm KnowBe4 published a blog post explaining how it accidentally hired a DPRK software engineer. A few months before that, an Arizona resident and four others were charged by prosecutors with helping DPRK IT workers land roles at U.S. companies.

These employees send (or are forced to send) most of their paychecks to the regime, which in turn helps the DPRK continue its various activities. Projects that are compromised by vulnerabilities inserted by these employees also risk losing more funds to North Korea. It’s not just a hypothetical concern; prosecutors have brought various charges alleging DPRK-affiliated IT workers were able to compromise companies.

Sanctions concerns first: Any company that hires an employee based in North Korea violates U.S. sanctions law. It doesn’t necessarily matter if this hiring was inadvertent – the companies can be prosecuted regardless.

Kessler reported that, so far at least, the U.S. government has “been lenient about bringing charges – on some level acknowledging that they were victims of, at best, an unusually elaborate and sophisticated type of identity fraud.”

It’s still something companies will have to pay closer attention to as they move forward, especially with crypto gaining increasing attention in recent months.

Companies also need to be concerned with getting hacked by the DPRK, which again is not just a hypothetical concern. Axie Infinity is perhaps one of the most prominent examples of how easily hackers can steal funds from a crypto company after just a small mistake. Axie was hacked in March 2022, losing $625 million at the time. U.S. officials tied North Korean hacking group Lazarus to the theft a month later.

Several other projects were hacked after employing DPRK IT workers, Kessler reported, including Sushi Finance.

Sam’s entire report is worth your attention – I’m re-linking it here – and it would behoove companies to consider how to mitigate these kinds of risks moving forward.

Stories you may have missed

• Delaware Judge Approves FTX Estate’s Bankruptcy Plan: A judge signed off on FTX’s plan to disburse funds to the bankrupt crypto exchange’s creditors. As previously reported, this plan will see creditors receive 100% of the U.S. dollar equivalent of the funds they had on the platform at the time of bankruptcy – but it’s not the same as if they received the funds or assets at their present-day values.

• Coinbase to Delist Unauthorized Stablecoins in EU by December: Crypto exchange Coinbase’s European markets will delist any stablecoins issued by a company that doesn’t have an e-money license by the end of the year to comply with the European Union’s Markets in Crypto Assets regulations.

• Former Bitcoin Dev Peter Todd Denies He’s Satoshi Hours Before HBO Documentary Airs: HBO aired a documentary Tuesday night Eastern time which claimed it would unveil who Bitcoin creator Satoshi Nakamoto is. Did it? Who knows. Former Bitcoin developer Peter Todd, the guy the documentary argued is Satoshi, denied he’s Satoshi in an email ahead of the documentary’s airing.

This week

• 12:00 UTC (1:00 p.m. WAT) A judge is supposed to announce whether detained Binance executive Tigran Gambaryan will be released on bail.

Elsewhere:

• (The New Yorker) The New Yorker took a look at the crypto industry’s approach to the 2024 election – and the hundreds of millions of dollars invested so far.

• (The Wall Street Journal) A hacking group with ties to the Chinese government was able to access networks operated by Verizon, AT&T and Lumen Technologies using wiretapping infrastructure. The revelation’s raising fresh concerns about how backdoors and other means of accessing people’s communications may be misused or abused.

• (404 Media) Smart glasses + facial recognition technology + the lack of privacy in digital data means a pair of students figured out how to create glasses that can instantly identify whoever the wearer is looking at and look up their addresses, Social Security numbers or other personal information. More from The Verge here as well.

• (Engadget) Someone hacked LEGO’s website to promote a crypto scam. Really, they went after LEGO? I’m disappointed.

If you’ve got thoughts or questions on what I should discuss next week or any other feedback you’d like to share, feel free to email me at nik@coindesk.com or find me on Twitter @nikhileshde.

You can also join the group conversation on Telegram.