North Korean IT workers used 30+ fake IDs to target crypto companies: report
A compromised device from a North Korean IT worker has exposed the inner workings of the team behind the $680,000 Favrr hack and their use of Google tools to target crypto projects.
- A compromised device belonging to a North Korean IT worker exposed the inner workings of threat actors.
- Evidence shows operatives used Google powered tools, AnyDesk, and VPNs to infiltrate crypto firms.
According to on-chain sleuth ZachXBT, the trail began with an unnamed source who gained access to one of the workers’ computers, uncovering screenshots, Google Drive exports, and Chrome profiles that pulled back the curtain on how the operatives planned and carried out their schemes.
Drawing on wallet activity and matching digital fingerprints, ZachXBT verified the source material and tied the group’s cryptocurrency dealings to the June 2025 exploit of the fan-token marketplace Favrr. One wallet address, “0x78e1a,” showed direct links to stolen funds from the incident.
Inside the operation
The compromised device showed that the small team — six members in total — shared at least 31 fake identities. To land blockchain development jobs, they amassed government-issued IDs and phone numbers, even buying LinkedIn and Upwork accounts to complete their cover.
An interview script found on the device showed them boasting of experience at well-known blockchain firms, including Polygon Labs, OpenSea, and Chainlink.
Google tools were central to their organized workflow. The threat actors were found to be using drive spreadsheets to track budgets and schedules, while Google Translate bridged the language gap between Korean and English.
Among the information pulled from the device was a spreadsheet that showed IT workers were renting computers and paying for VPN access to buy fresh accounts for their operations.
The team also relied on remote access tools such as AnyDesk, allowing them to control client systems without revealing their true locations. VPN logs tied their activity to multiple regions, masking North Korean IP addresses.
Additional findings revealed the group looking up ways to deploy tokens across different blockchains, scouting AI firms in Europe, and mapping out fresh targets in the crypto space.
North Korean threat actors use remote jobs
ZachXBT found the same pattern flagged in multiple cybersecurity reports — North Korean IT workers landing legitimate remote jobs to slip into the crypto sector. By posing as freelance developers, they gain access to code repositories, backend systems, and wallet infrastructure.
One document uncovered on the device was interview notes and preparation materials likely meant to be kept on-screen or nearby during calls with potential employers.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Ahead of Earnings Report, Bank of America Raises Target Price for TSMC: 2nm Capacity Ramp-Up Boosts Sales Expectations and Profit Margins
Ahead of TSMC’s Q3 earnings report, Bank of America Merrill Lynch raised its US stock target price to $620 and maintained a Buy rating. Q3 revenue is expected to exceed the upper end of guidance, with the proportion of 2nm process rising from 3% to 11% in a single quarter, becoming the biggest highlight. Q4 sales are expected to increase by another 11% quarter-on-quarter, targeting a full-year growth rate of 40%. The current stock price corresponds to a forward P/E ratio of 16, which is still at the historical median. Bank of America believes the valuation is “not demanding,” implying approximately 37% upside to the target price.
AI trading cools down and storage chip competition intensifies, Korean stocks plunge over 5%, marking a second consecutive day of sharp decline; SK Hynix drops nearly 8%
On Tuesday, the Korea Composite Stock Index (KOSPI) dropped by as much as 5.1%, triggering the Sidecar circuit breaker mechanism on the exchange and suspending programmatic sell orders for five minutes. Both Samsung Electronics and SK Hynix fell more than 6%, marking five consecutive days of decline. Japan's SoftBank Group plunged over 8%, while AI industry-related stocks such as Tokyo Electron and Advantest also dropped by more than 5%.
Wall Street giants' financial reports tonight: With stock prices trapped in technical correction, even a 20% profit increase can hardly ease triple anxiety
Shares of major US banks hovered in a technical correction zone on Tuesday as the earnings season kicked off, with long-term borrowing costs rising to their highest levels in decades. This has heightened market attention on bank executives’ assessments of US consumer health and credit prospects.
UBS Earnings Season Preview: Strong Momentum from AI Spending, Favoring Lam Research (LRCX.US) and Texas Instruments (TXN.US), Remaining Cautious on Western Digital (WDC.US)
Lam Research (LRCX.US), Texas Instruments (TXN.US), and Western Digital (WDC.US) are set to release their quarterly earnings reports in the coming days. UBS believes that, with continued high spending on artificial intelligence, all three companies are likely to benefit from this trend.
Crypto prices
More
