ZachXBT exposes North Korean IT workers infiltrating crypto projects to execute hacks, revealing a complex scheme involving fake identities and substantial financial gains.
Recent investigations reveal that North Korean IT professionals have been masquerading as regular developers to penetrate cryptocurrency projects before executing hacks. ZachXBT, an on-chain analyst, has shared insights after examining data leaked from a North Korean payment server.
The analysis disclosed 390 accounts along with chat logs and cryptocurrency transactions that demonstrate a sophisticated hacking operation involving fake identities and forged documents. ZachXBT remarked, "The scheme is complex, with illicit conversions of crypto to fiat amounting to approximately $1 million each month."
Operational Mechanics
In particular, one IT worker, referred to as Jerry, fell victim to a hack that revealed communications involving fraudulent job applications and illicit transfer activities. The compromised accounts were associated with an internal payment platform resembling Discord, where a default password, "123456," remained unchanged for multiple users.
The investigation identified three companies, Sobaeksu, Saenal, and Songkwang, all sanctioned by the Office of Foreign Assets Control (OFAC). Following the report's release, the targeted payment site was rendered inaccessible.
Financial Transactions
Between December 2025 and April 2026, users on a WebMsg platform, particularly under the alias Rascal, engaged in discussions about payment processes and creating fake personas. They confirmed that payments were handled by an admin account linked to numerous transactions, with over $3.5 million traced to various wallets.
The pattern of operation involved converting cryptocurrency into fiat using Chinese bank accounts and services like Payoneer. ZachXBT used the information to map out the organizational framework of the North Korean network.
Threat Assessment
While the group analyzed poses a lower threat compared to other notorious hacker groups, their operations still yield significant financial gains. Monthly earnings for these North Korean developers are estimated to reach millions, confirming the ongoing risk in the crypto space.
Furthermore, a viral incident involving a North Korean IT worker's inability to insult Kim Jong Un highlighted the difficulty of identifying such personnel within the industry. This incident underscores the challenges of discerning true identities in a landscape fraught with deception.
