An Ethereum-Funded Project Reveals 100 North Korean IT Workers in Crypto Assets

Ketman Project, funded by the Ethereum Foundation, has identified about 100 North Korean IT workers who are suspected of operating across 53 crypto asset projects, according to a record from the ETH Rangers Program published on April 16.

This six-month initiative, supported through aid funding from the Ethereum Foundation’s ETH Rangers Program, specifically targets detecting and expelling bad actors from North Korea who have infiltrated Web3 organizations using fake identities.

How North Korea Uses Fake Identities and Fake KYC Documents

Ketman’s latest investigation reveals how actors linked to North Korea pose as Japanese developers on the Web3 freelance platform OnlyDust.

The perpetrators use AI-generated profile photos, fake names such as “Hiroto Iwaki” and “Motoki Masuo,” and they also submit fake Japanese identity documents during the verification process.

Researchers confirmed the deception during a video call, when a suspect was asked to introduce themself in Japanese, they removed their headset and immediately left the call.

The team traced at least three clusters of perpetrators across 11 repositories, where 62 pull requests had been merged before they were detected.

Open-Source Tools and Industry Frameworks

In addition to conducting individual investigations, Ketman also developed gh-fake-analyzer, an open-source GitHub profile analysis tool now available on PyPI.

The project also helped develop the DPRK IT Workers Framework together with Security Alliance (SEAL), which has now become a standard reference in the industry.

The ETH Rangers Program, which began at the end of 2024 with Secureum, The Red Guild, and SEAL, funded a total of 17 stipend recipients.

The combined results include more than US$5.8 million in recovered funds, 785 reported security vulnerabilities, and 36 incidents successfully handled.

North Korean operatives have stolen crypto assets worth billions in recent years. Security researchers warn that IT worker infiltration often becomes a stepping stone for larger, more coordinated supply-chain attacks carried out by North Korean hacking teams.

$ETH ‌
#AIInfraShiftstoApplications
#AnthropicvsOpenAIHeatsUp
#AnthropicvsOpenAIHeatsUp