Marie

United

Bitcoin

when

would

North Korea’s IT operatives are shifting strategies and recruiting freelancers to provide proxy identities for remote jobs.
Operatives are contacting job seekers on Upwork, Freelancer and GitHub before moving conversations to Telegram or Discord, where they coach them through setting up remote access software and passing identity verifications.
In earlier cases, North Korean workers <a href="https://cointelegraph.com/news/cz-crypto-seal-60-north-korean-hackers" rel="noopener noreferrer nofollow">scored remote gigs using fabricated IDs</a>. According to Heiner García, a cyber threat intelligence expert at Telefónica and a blockchain security researcher, operatives are now <a href="https://www.securityalliance.org/news/2025-11-dprk-itw-recruiters" rel="noopener noreferrer nofollow" target="_blank">avoiding</a> those barriers by working through verified users who hand over remote access to their computers.
The real owners of the identities receive only a fifth of the pay, while the rest of the funds are redirected to the operatives through cryptocurrencies or even traditional bank accounts. By relying on real identities and local internet connections, the operatives can bypass systems designed to flag high-risk geographies and VPNs.
<figure><img alt="Cryptocurrencies, Cybercrime, North Korea, Crimes, Cybersecurity" src="https://s3.cointelegraph.com/uploads/2025-11/019a52f0-5365-70ed-9595-dad5bd5bb545" title="">
 <figcaption style="text-align: center;">The recruitment process allows operatives to maintain ongoing access to identities and shift to new ones when flagged. Source: Heiner García/SEAL
 </figcaption>
</figure>
<h2 id="inside-the-evolving-recruitment-playbook-of-north-korean-it-workers">Inside the evolving recruitment playbook of North Korean IT workers</h2>
Earlier this year, García set up a dummy crypto company and, together with Cointelegraph, <a href="https://cointelegraph.com/news/north-korean-spy-reveals-ties-in-fake-job-interview" rel="noopener noreferrer nofollow">interviewed a suspected North Korean operative</a> seeking a remote tech role. The candidate claimed to be Japanese, then abruptly ended the call when asked to introduce himself in Japanese.
García continued the conversation in private messages. The suspected operative asked him to buy a computer and provide remote access.
The request aligned with patterns García would later encounter. Evidence linked to suspicious profiles included onboarding presentations, recruitment scripts and identity documents “reused again and again.”
Related: <a href="https://cointelegraph.com/news/north-korean-spy-reveals-ties-in-fake-job-interview" rel="noopener noreferrer nofollow">North Korean spy slips up, reveals ties in fake job interview</a>
García told Cointelegraph:
<blockquote>
 They install AnyDesk or Chrome Remote Desktop and work from the victim’s machine so the platform sees a domestic IP.”
</blockquote>
The people handing over their computers “are victims,” he added. “They are not aware. They think they are joining a normal subcontracting arrangement.”
<figure><img alt="Cryptocurrencies, Cybercrime, North Korea, Crimes, Cybersecurity" src="https://s3.cointelegraph.com/uploads/2025-11/019a52f0-c6fa-7639-9440-eb43e901a019" title="">
 <figcaption style="text-align: center;">An email thread shows how recruiting is conducted through a freelancer platform. Source: Heiner García/SEAL
 </figcaption>
</figure>
According to chat logs he reviewed, recruits ask basic questions such as “How will we make money?” and perform no technical work themselves. They verify accounts, install remote-access software and keep the device online while operatives apply for jobs, speak to clients and deliver work under their identities.
Though most appear to be “victims” unaware of who they’re interacting with, some appear to know exactly what they are doing.
In August 2024, the US Department of Justice arrested Matthew Isaac Knoot of Nashville for running a “laptop farm” that allowed North Korean IT workers to appear as US-based employees using stolen identities.
More recently in Arizona, Christina Marie Chapman was sentenced to more than eight years in prison for hosting a similar operation that funneled more than $17 million to North Korea.
<figure><img alt="Cryptocurrencies, Cybercrime, North Korea, Crimes, Cybersecurity" src="https://s3.cointelegraph.com/uploads/2025-11/019a52f5-42f5-76f8-ab6f-4812bee95aa2" title="">
 <figcaption style="text-align: center;">Chapman’s laptop farm duped over 300 US companies. Source: <a href="https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-information-technology-worker-fraud-scheme-generated-revenue" rel="noopener noreferrer nofollow" target="_blank">Office of Public Affairs</a>
 </figcaption>
</figure>
<h2 id="a-recruitment-model-built-around-vulnerability">A recruitment model built around vulnerability</h2>
The most prized recruits are in the US, Europe and some parts of Asia, where verified accounts provide access to high-value corporate jobs and fewer geographic restrictions. But García also observed documents belonging to individuals from regions with economic instability, such as Ukraine and Southeast Asia.
“They target low-income people. They target vulnerable people,” García said. “I even saw them trying to reach people with disabilities.”
<figure><img alt="Cryptocurrencies, Cybercrime, North Korea, Crimes, Cybersecurity" src="https://s3.cointelegraph.com/uploads/2025-11/019a52f6-578d-710e-b82e-081fcbbc4b90" title="">
 <figcaption style="text-align: center;">Email evidence shows operatives targeting professionals with disabilities. Source: Heiner García/SEAL
 </figcaption>
</figure>
North Korea has spent years infiltrating the tech and crypto industries to generate revenue and gain corporate footholds abroad. The United Nations <a href="https://main.un.org/securitycouncil/en/sanctions/1718/panel_experts/reports" rel="noopener noreferrer nofollow" target="_blank">said</a> DPRK IT work and crypto theft are allegedly funding the country’s missile and weapons programs.
Related: <a href="https://cointelegraph.com/news/lazarus-group-bybit-sony-crypto-supervillain" rel="noopener noreferrer nofollow">From Sony to Bybit: How Lazarus Group became crypto’s supervillain</a>
García said the tactic goes beyond crypto. In one case he reviewed, a DPRK worker used a stolen US identity to present themselves as an architect from Illinois, bidding on construction-related projects on Upwork. Their client received completed drafting work.
Despite the focus on crypto-related laundering, García’s research found that traditional financial channels are also being abused. The same identity-proxy model allows illicit actors to receive bank payments under legitimate names.
<figure><img alt="Cryptocurrencies, Cybercrime, North Korea, Crimes, Cybersecurity" src="https://s3.cointelegraph.com/uploads/2025-11/019a52f7-6e62-7d77-a51f-02752719495a" title="">
 <figcaption style="text-align: center;">A suspected operative requests payment to a bank account after completing freelance work. Source: Heiner García
 </figcaption>
</figure>
“It’s not only crypto,” García said. “They do everything — architecture, design, customer support, whatever they can access.”
<h2 id="why-platforms-still-struggle-to-spot-who-s-really-working">Why platforms still struggle to spot who’s really working</h2>
Even as hiring teams grow more alert to the risk of North Korean operatives securing remote roles, detection typically arrives only after unusual behavior triggers red flags. When an account is compromised, the actors pivot to a new identity and keep working.
In one case, after an Upwork profile was suspended for excessive activity, the operative instructed the recruit to ask a family member to open the next account, according to chat logs reviewed.
<figure><img alt="Cryptocurrencies, Cybercrime, North Korea, Crimes, Cybersecurity" src="https://s3.cointelegraph.com/uploads/2025-11/019a52f8-2bf0-7ceb-8231-778675914d3f" title="">
 <figcaption style="text-align: center;">Account provider “Ana” is asked to tap family members for new accounts. Source: Heiner García
 </figcaption>
</figure>
This churn of identities makes both accountability and attribution difficult. The person whose name and paperwork are on the account is often deceived, while the individual actually doing the work is operating from another country and is never directly visible to freelancing platforms or clients.
The strength of this model is that everything a compliance system can see looks legitimate. The identity is real, and the internet connection is local. On paper, the worker meets every requirement, but the person behind the keyboard is someone entirely different.
García said the clearest red flag is any request to install remote-access tools or let someone “work” from your verified account. A legitimate hiring process doesn’t need control of your device or identity.
Magazine: <a href="https://cointelegraph.com/magazine/bitcoin-kyle-chasse-venture-capitalist-youtube-strike-cointelegraph/" rel="noopener noreferrer nofollow">Bitcoin OG Kyle Chassé is one strike away from a YouTube permaban</a>

Are you a freelancer? North Korean spies may be using you

Table of Contents

Cointelegraph

Other articles published on Nov 5, 2025

Join our free newsletter for daily crypto updates!