Threat intelligence researchers built a fake Decentralized Finance (DeFi) startup, hired suspected North Korean IT workers as developers, and watched them from the inside.

The operation reversed the usual infiltration playbook. Instead of catching operatives trying to break in, researchers watched them work after they cleared interviews.

How the Fake Startup Exposed North Korean IT Workers

The investigation was a joint effort by BCA LTD’s Mauro Eldritch, NorthScan’s Heiner García, and ANY.RUN. Researchers registered Ballena Azul LTD as a protocol serving cryptocurrency whales.

They gave it a website, corporate branding, and a matching UK company registration to look legitimate. They then posed as founders and a team lead. 

The researchers used the ANY.RUN sandbox platform as the work environment. It recorded every move of the operatives. Angelo Cruz, a recruiter the team met on GitHub, supplied the first developer. 

That hire recommended a second, who brought in a third. All three cleared interviews and received access to virtual desktops that were actually controlled recording environments.

The operatives are described throughout the report as suspected members of Famous Chollima, a unit linked to North Korea’s Lazarus Group that specializes in placing fake IT workers at Western firms.

Follow us on X to get the latest news as it happens

What the Researchers Found

The developers submitted forged US credentials during onboarding. This includes driver’s licenses, stolen Social Security numbers, and accounts at Lead Bank, Citibank, and Wise. 

Metadata on one license showed it had been processed with Google Gemini and carried an embedded SynthID watermark. This exposed the forgery almost immediately.

“By now, we had fake identities, stolen SSNs, mule bank accounts, possible facilitator safe houses, and cryptocurrency wallets with transaction history,” the researchers wrote.

The workers leaned heavily on artificial intelligence. They used ChatGPT to write code they appeared not to understand and to complete assignments. Live translation tools also ran during interviews and daily standups.

The operation also surfaced supporting infrastructure. Researchers logged AstrillVPN exit nodes, servers hosted on Vultr and Gorilla Servers, and cryptocurrency wallets holding transaction history. One operative server was already tagged across threat intelligence feeds, a sign it had been recycled from earlier campaigns.

“The findings show that DPRK IT worker schemes are not only a hiring risk. Once inside, operatives can gain legitimate access to code, systems, intellectual property, and trusted business processes,” the report read.

North Korean hackers have posed a persistent threat to the crypto industry. TRM Labs attributed 76% of 2026 crypto-hack losses through April to DPRK crews. Theft reached $2 billion in 2025.

The infiltration tactic works differently. North Korean workers pose as engineers to win remote jobs, then steal secrets or plant a way back in. One Ethereum (ETH)-funded project previously identified 100 suspected North Korean IT workers across 53 crypto projects.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Source: BeInCrypto