The Ethereum Foundation's Ketman project has uncovered 100 North Korean IT agents operating in crypto firms under false identities.
A recent initiative funded by the Ethereum Foundation has revealed that around 100 North Korean IT specialists have been operating under false identities in the cryptocurrency sector over the past six months. This finding comes from the Ketman project, part of the ETH Rangers program, which aims to enhance security within the Ethereum ecosystem.
The ETH Rangers program, launched in late 2024, has successfully reported over 785 vulnerabilities and recovered more than $5.8 million. According to a recent update, the program has also identified more than 100 operatives linked to North Korea, highlighting the ongoing security risks in decentralized networks.
The Ketman project, funded through the ETH Rangers initiative, focuses specifically on identifying fraudulent developers associated with North Korean operations. Their research indicates that these agents have been embedded in Web3 companies, potentially compromising project infrastructures while conducting intelligence activities.
In their six-month investigation, the Ketman team alerted 53 organizations about the presence of suspected North Korean agents within their ranks. Their findings included a range of telltale signs that characterize North Korean IT operatives, such as:
- Using the same avatars and metadata across multiple GitHub accounts;
- Accidental sharing of unrelated email addresses during video calls;
- Setting their system languages to Russian or other languages inconsistent with their claimed nationalities;
- Exhibiting unusual communication patterns and working hours for their declared time zones.
Although the specific methods used to identify these agents have not been fully disclosed, Ketman has developed an open-source tool to help detect suspicious activities on GitHub. They have also partnered with the nonprofit Security Alliance to establish a framework aimed at identifying North Korean IT workers during the hiring process.
The Ethereum Foundation emphasized that this initiative is crucial in addressing significant operational security threats currently facing the Ethereum ecosystem. A total of 17 scholars were supported through the ETH Rangers program, contributing to various aspects of security, research, and incident response.
Notably, on April 1, the Drift Protocol, a decentralized finance platform on Solana, experienced a substantial hack valued at $280 million, which cybersecurity experts attributed to North Korean hackers, underscoring the ongoing threat posed by these actors in the crypto landscape.
