2024

ZachXBT

Million

WazirX

<p>Infamous for several hacking incidents of late, developers from North Korea have been again involved in a HIGH-PROFILE crypto scam.&nbsp;</p>
<p>According to the latest investigation, a group of DPRK hackers had successfully gained access to more than 25 crypto projects worldwide by posing as developers and stealing over $1.3 Million.</p>
<p>The new hack comes weeks after the recent hacking incident on WazirX crypto exchange that led to loss of $230 Million worth investor fund, in which the name of North Korean group Lazarus emerged.</p>
<p>The prominent security researcher ZachXBT recently shared a <a href="https://x.com/zachxbt/status/1824047425822310580" target="_blank" rel="noopener noreferrer nofollow">post</a> revealing that a group of DPRK IT workers have been found employed in more than 25 crypto projects with fake identities. They have been hired as developers due to their good resumes, decent work history and fake working experience.&nbsp;</p>
<figure class="wp-block-image"><img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeVusYKMCtNdcEUp7kOmWw7qT61ke_x_uLEqtV3sPT3Hit0ZKa_r-vtcChTmab49CY4zYIwCmJ1HQaqx5VeccBdn9CoWIUvdF_4o38pUUN9IRMz6y09C7DLJGn3dMY-NI4yp3sBvVZkDbujtxCTdYx9dFs?key=rcqHzQnCUST_8Ibax8m6Zg" alt="AD 4nXeVusYKMCtNdcEUp7kOmWw7qT61ke x uLEqtV3sPT3Hit0ZKa r vtcChTmab49CY4zYIwCmJ1HQaqx5VeccBdn9CoWIUvdF 4o38pUUN9IRMz6y09C7DLJGn3dMY">
</figure>
<h2 class="wp-block-heading" id="how-the-scam-by-north-korean-developers-unfolded">How the Scam by North Korean “Developers” unfolded?</h2>
<p>ZachXBT said that he contacted all the victim teams regarding the suspicious employee records and tracked 21 developer payment wallets. He also revealed fake identities of all and found all of those addresses leading to a common IT worker address.&nbsp;</p>
<figure class="wp-block-image"><img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcjhW4xXS-R8nsPMp_k77CLvBAUtsF_LJqBexRZdu5yVssqknL0opHq7aVhTZP_wBvgbI3O_gWDTEySKS2o4r32TAr8kXa9bK4FVpKqo45Nkb1_EzG6agwklIeS73ILcGHw_HYtOhzGQ60YwosLFJsPWQ8?key=rcqHzQnCUST_8Ibax8m6Zg" alt="AD 4nXcjhW4xXS">
 <figcaption class="wp-element-caption"><em>Fake DPRK IT Employee List – ZachXBT</em>
 </figcaption>
</figure>
<p>This scandal came to light after a project team reached out to ZachXBT for assistance on a $1.3 million theft. As per the team, the security of the project’s treasury wallet was compromised due to a malicious code injected by one of the team members. They asked ZachXBT to get to the root cause of this low-key threat while it ended up on a serendipitous discovery.&nbsp;</p>
<p>The findings from the research and onchain transactions shows that all those fake employee payment addresses were leading to the same crypto exchange deposit address, supposedly of the operating entity of the whole group.&nbsp;</p>
<p>In contrast, this exchange address is also connected to the OFAC sanctioned hacker known as Sim Hyon Sop. This loop continued for almost a year – starting from July 2023 to July 2024 – until it came to know following this recent revelation.&nbsp;</p>
<h2 class="wp-block-heading" id="what-was-the-modus-operandi-of-north-korean-hackers">What was the modus operandi of North Korean Hackers?</h2>
<p>While most of these developers were capable of showcasing their extraordinary skills, they managed to hide the real identity and submitted fake IDs to their employer projects. They also had good looking resumes and remarkable github activity which were enough for employers to believe in them.&nbsp;</p>
<p>In addition, this group of people also referred each other to vacant posts at their respective projects and teams. As all of these fake employees were sending payments – which they received as compensation – to common addresses, it suggests that they all were one small group rather than separate employees.&nbsp;</p>
<h2 class="wp-block-heading" id="conclusion">Conclusion</h2>
<p>The recent hacking incident has led to debates within the crypto community regarding the growing sophistication and persistence of North Korean cyber activities in the cryptocurrency space. By infiltrating numerous projects under false pretenses, these DPRK developers have not only stolen significant funds but also exposed the vulnerabilities within the hiring and security practices of many crypto projects.&nbsp;</p>
<p>The revelations by ZachXBT serve as a critical reminder for the industry to implement more stringent vetting processes and heightened security measures to protect against such threats in the future.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>Also Read: <a href="https://www.cryptotimes.io/2024/08/02/what-went-wrong-with-wazirx-indias-biggest-crypto-hack/" target="_blank" rel="noopener noreferrer nofollow">What Went Wrong with WazirX? Unraveling India’s biggest crypto hack</a></p>
</blockquote>

How North Korean Hackers stole $1.3 M by posing as developers

Table of Contents

The Crypto Times

Other articles published on Aug 17, 2024

California committee advances AI regulation bill

Expert Says RCO Finance Will Yield More Profits than TON and SOL in the Long Run

Terra Founder Do Kwon Settled With SEC: What's Next for LUNC and LUNA?

Roman Sterlingov Battles 30-Year Prison Term in Bitcoin Fog Case

AMP Price Prediction: Will AMP Price Record A 2X Surge This Q3?

Whales Increase Altcoin Holdings in August 2024

Join our free newsletter for daily crypto updates!