• Four North Korean agents used fake identities to land remote IT jobs at a U.S. crypto startup and stole nearly $900,000 in two incidents.
  • The DOJ seized 29 financial accounts, 21 fraudulent websites, and 200 computers linked to DPRK’s crypto infiltration schemes.

Federal prosecutors in Georgia have charged four North Korean nationals with infiltrating a U.S.-based blockchain startup under fake identities, stealing nearly $1 million in crypto.

The five-count indictment includes wire fraud and money laundering charges stemming from two separate incidents in 2022.

The defendants allegedly posed as remote IT developers, using stolen identities and fake documents to gain employment with an Atlanta-based crypto firm.

Once inside, they stole $175,000 and $740,000 in two transactions. Authorities say the funds were laundered through crypto mixers and exchanges using falsified documentation.

Officials believe this is part of a broader strategy by the Democratic People's Republic of Korea (DPRK) to fund its weapons programs. Described by prosecutors as “North Korean IT workers,” the agents embedded themselves in companies to manipulate security systems and facilitate insider breaches.

“These tactics form a pattern that has increasingly become standard operating procedure,”

said Andrew Fierman, head of national security at Chainalysis. The agents not only sent compensation back to North Korea, but also patiently waited for opportunities to siphon off company funds.

Exploiting Web3 Vulnerabilities

Vladimir Sobolev, a threat researcher at Hexens, blamed crypto's remote-first culture and lax vetting processes.

“Many teams avoid in-person meetings and prefer hiring more 'cheap' developers than hiring well-known guys in our sector,” he said, calling it a fundamental issue.

The DOJ’s announcement follows a series of enforcement actions across 16 U.S. states. Authorities seized 29 financial accounts, 21 fraudulent websites, and around 200 computers used in so-called "laptop farms", remote access points for DPRK agents to control crypto operations from abroad.

Fierman emphasized the importance of recognizing such threats, as North Korea’s cyber schemes continue evolving.

Edited by Annette George