North Korean IT Workers Infiltrated DeFi Platforms for 7 Years

Security researcher Taylor Monahan has revealed that North Korean IT workers have been embedding themselves in cryptocurrency companies and decentralized finance (DeFi) projects for at least seven years. According to Monahan, over 40 DeFi platforms, including widely known protocols, have employed North Korean workers at some stage of development. She emphasized that the “seven years of blockchain dev experience” on their resumes is accurate.

North Korea-affiliated hacking collective Lazarus Group has stolen an estimated $7 billion in crypto since 2017, according to analysts at R3ACH Network. The group has been linked to the Ronin Bridge exploit ($625 million, 2022), WazirX hack ($235 million, 2024), and the Bybit heist ($1.4 billion, 2025).

DeFi Platforms Targeted

Drift Protocol recently reported a $280 million exploit, attributing it to North Korean-affiliated actors. These attacks often involve third-party intermediaries using fully constructed identities, employment histories, and professional networks to gain trust. Tim Ahhl, founder of Titan Exchange, recalled interviewing a candidate later identified as a Lazarus operative.

Threat Awareness and Security Measures

Blockchain sleuth ZachXBT explained that Lazarus threats vary in complexity but are relentless. Businesses are encouraged to use the US Office of Foreign Assets Control (OFAC) sanctions lists to screen potential hires and remain alert to IT worker fraud patterns.

Disclaimer

This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.