Holograph

Silk Road

ZachXBT

when

Tornado

<p class="is-style-lead">Cybersecurity expert ZachXBT’s recent tweets suggest a sophisticated scheme involving North Korean IT workers posing as crypto developers is taking place.</p>
<p>The <a href="https://x.com/zachxbt/status/1824047425822310580" target="_blank" rel="noopener noreferrer nofollow">operation</a> led to the theft of $1.3 million from a project’s treasury and exposed a network of over 25 compromised crypto projects active since June 2024.</p>
<p>ZachXBT’s research strongly suggests that a single entity in Asia, likely operating out of <a href="https://crypto.news/tag/North-Korea/" target="_blank" data-type="link" data-id="https://crypto.news/tag/North-Korea/" rel="noopener noreferrer nofollow">North Korea</a>, is receiving $300,000 to $500,000 per month by working simultaneously on over 25 crypto projects using fake identities.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">6/ A number of experienced teams have hired these devs so it’s not fair to them single as the ones to blame. <br><br>Some indicators teams can look out for in the future includes: <br><br>1) They refer each other for roles <br>2) Good looking resumes / GitHub activity although sometimes lie…</p>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1824047480121729425?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">August 15, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>You might also like: <a href="https://crypto.news/suspects-in-14m-holograph-hack-arrested-by-eu-authorities/" rel="noopener noreferrer nofollow"> Suspects in $14m Holograph hack arrested by EU authorities </a></p>
<h2 class="wp-block-heading" id="the-theft-and-laundering-scheme">The theft and laundering scheme</h2>
<p>The incident began when a publicly anonymous team reached out to ZachXBT for help after $1.3 million was stolen from their treasury. Unbeknownst to them, they had hired multiple North Korean IT workers who used fake identities to infiltrate the team.</p>
<p>The stolen funds, totaling $1.3 million, were quickly laundered through a sequence of transactions, including transferring to a theft address, bridging from (<a href="https://crypto.news/price/solana/" data-type="link" data-id="https://crypto.news/price/solana/" target="_blank" rel="noopener noreferrer nofollow">SOL</a>) to Ethereum (<a href="https://crypto.news/price/ethereum/" data-type="link" data-id="https://crypto.news/price/ethereum/" target="_blank" rel="noopener noreferrer nofollow">ETH</a>) via deBridge, depositing 50.2 ETH to Tornado Cash, and ultimately transferring 16.5 ETH to two different exchanges.</p>
<p>You might also like: <a href="https://crypto.news/us-govt-sent-594m-silk-road-bitcoin-to-coinbase/" rel="noopener noreferrer nofollow"> US govt sent $594m Silk Road Bitcoin to Coinbase </a></p>
<h2 class="wp-block-heading" id="mapping-the-network">Mapping the network</h2>
<p>Further investigation revealed that the malicious developers were part of a larger network. By tracking multiple payment addresses, the investigator mapped out a cluster of 21 developers who had received <a href="https://x.com/zachxbt/status/1824047425822310580" target="_blank" rel="noopener noreferrer nofollow">approximately $375,000</a> in the last month alone.</p>
<p>The investigation also connected these activities to previous transactions totaling $5.5 million, which flowed into an exchange deposit address from July 2023 to 2024.&nbsp;</p>
<p>These payments <a href="https://x.com/zachxbt/status/1824047465827602550" target="_blank" rel="noopener noreferrer nofollow">were linked</a> to North Korean IT workers and Sim Hyon Sop, a figure sanctioned by the Office of Foreign Assets Control (OFAC). Throughout the investigation, several concerning activities came to light, including instances of Russian Telecom IP overlap among developers who were reportedly based in the US and Malaysia.</p>
<p>Additionally, one developer accidentally exposed other identities while being recorded. Further investigations revealed that payment addresses were closely linked to those of OFAC-sanctioned individuals, such as Sang Man Kim and Sim Hyon Sop.&nbsp;</p>
<p>The involvement of recruitment companies in placing some developers added complexity to the situation. Additionally, several projects employed at least three North Korean IT workers who had referred each other.</p>
<p>You might also like: <a href="https://crypto.news/vitalik-buterin-donated-532k-in-animal-coins-to-charity/" rel="noopener noreferrer nofollow"> Vitalik Buterin donated $532k in ‘animal coins’ to charity </a></p>
<h2 class="wp-block-heading" id="preventive-measures">Preventive measures</h2>
<p>ZachXBT <a href="https://x.com/zachxbt/status/1824047480121729425" target="_blank" rel="noopener noreferrer nofollow">pointed out</a> that many experienced teams have inadvertently hired deceptive developers, so it’s not entirely fair to blame the teams. However, there are several measures that teams can take to protect themselves in the future.&nbsp;</p>
<p>These measures include being cautious of developers who refer each other for roles, scrutinizing resumes, thoroughly verifying KYC information, asking detailed questions about developers’ claimed locations, monitoring for developers who are fired and then reappear under new accounts, watching for a decline in performance over time, regularly reviewing logs for anomalies, being cautious of developers using popular NFT profile pictures, and noting potential language accents that could indicate origins in Asia.</p>

North Korean workers tied to $1.3M crypto theft: ZachXBT

Table of Contents

crypto.news

Other articles published on Aug 15, 2024

Helium, Notcoin And Dogwifhat Lead The 3% Crypto Market Correction As The Top 10 Cryptos All Tumb...

Euclid Protocol Launches its First Incentivized Testnet, Aurora

Ripple Ordered to Pay $125M in Securities Law Violation Case, Possibly Ending SEC vs. Ripple Conf...

Top Altcoins Including AAVE, CRV, and ENA Sees Significant Inflow.

Avalanche Poised for a Bounce Back, Analyst Sees Bullish Potential

US Spot Bitcoin ETFs End Two-day Inflow Streak Amid BTC Price Dip

Join our free newsletter for daily crypto updates!