A network of North Korean IT workers has been exposed after reportedly earning more than $3.5 million in cryptocurrency by posing as freelance developers and software engineers. The operation was uncovered after a counterhacker gained access to one of the workers’ devices, revealing internal data later shared publicly by blockchain investigator ZachXBT.
According to the leaked information, one worker identified as “Jerry” was part of a team of about 140 members. The group was generating close to $1 million per month, with earnings accumulated since late November. Many of the individuals reportedly secured remote jobs by using falsified identities and forged documentation to appear as legitimate applicants.
Payment coordination reportedly took place through a website known as luckyguys.site, where members used a shared and easily guessed password, “123456,” to access accounts. Some individuals using the platform were linked to entities believed to be associated with Sobaeksu, Saenal, and Songkwang, organizations previously sanctioned by the United States Office of Foreign Assets Control.
Crypto Payments Routed Through Online Platforms and Foreign Accounts
Investigators found that cryptocurrency payments earned by the workers were converted into traditional currency and transferred to bank accounts in China using online financial services such as Payoneer. Blockchain tracing also identified connections between the wallets used in this operation and addresses previously blacklisted by Tether in December.
Additional records revealed that the group maintained an internal leaderboard tracking how much cryptocurrency each worker generated, with transaction links connected to blockchain explorer pages. Evidence also showed attempts to apply for developer and technical roles through popular job platforms, while some members used virtual private networks and falsified identification documents to avoid detection.
Security analysts warn that state-backed cyber groups linked to North Korea remain a persistent threat, with total losses attributed to such operations exceeding $7 billion since 2009. Major incidents associated with these groups include large-scale breaches targeting cryptocurrency platforms and financial infrastructure.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.