Human

Nothing

Security

<p>North Korean hackers have already siphoned millions in bitcoin and ether, ranking among the worst nightmares of the crypto community. Feared, hunted, cursed, they nevertheless evade every net. For recently, they no longer just steal: they recruit, organize, infiltrate, and structure. GitHub, Upwork, Freelancer… all platforms have become hunting grounds. And what they now aim at is no longer just a jackpot but the very framework of the decentralized economy.</p>
<div class="in-brief">
 <div class="in-brief--container">
  <span></span> <span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>North Korean hackers impersonate recruiters and target freelancers on GitHub or Upwork.</li>
   <li>They use malware, forged documents, and AI to impersonate identities and deceive platforms.</li>
   <li>Victims are often vulnerable: women, Ukrainians, or precarious people lured by fake jobs.</li>
   <li>Payments pass through proxies and then go as crypto to the North Korean regime’s networks.</li>
  </ul>
 </div>
</div>
<h2 id="h-when-ai-recruiters-and-fake-profiles-infest-tech-platforms">When AI Recruiters and Fake Profiles Infest Tech Platforms</h2>
<p>In 2024, Pyongyang, which has more than <a href="https://www.cointribune.com/en/cz-alerts-on-60-fake-north-korean-developers-infiltrated-into-crypto-platforms/" target="_blank" rel="noopener noreferrer nofollow">60 developers on crypto platforms</a>, has taken a new step in its digital war. The regime’s hackers no longer simply apply for offers: they create them. On Upwork, Freelancer, or GitHub, they publish ads designed to lure developers specialized in crypto. Behind these seemingly ordinary offers lies <a href="https://www.securityalliance.org/news/2025-11-dprk-itw-recruiters" target="_blank" rel="noopener noreferrer nofollow">a well-oiled plan</a>: the candidate is invited to download a project hosted on GitHub, supposed to serve as a technical test. The code contains malware, often of the BeaverTail type.</p>
<div class="my-4">
 <div class="ads ">
 </div>
</div>
<div class="wp-block-image">
 <figure class="aligncenter size-large">
  <img src="https://www.securityalliance.org/_next/image?url=https%3A%2F%2Fseal-news-image-storage.s3.us-east-2.amazonaws.com%2Fimage-1762291236895.png&amp;w=1080&amp;q=75" alt="Infographic reflecting the modus operandi of North Korean hackers">
  <figcaption>
   Modus operandi of North Korean hackers – Source: Security Alliance
  </figcaption>
 </figure>
</div>
<p>To make these traps undetectable, North Korean agents use AI to generate faces, falsify voices, and produce ultra-credible official documents. They use sophisticated tools to enhance identity files, alter photos, and modify voices to deceive verification systems.&nbsp;</p>
<p>Nothing is left to chance: the appearance, the sound, the administrative details are optimized to pass checks without raising the slightest suspicion.</p>
<blockquote class="wp-block-quote">
 <p><em>Require a live and interactive video interview during the selection process, to ensure the candidate’s appearance matches the profile photo and submitted documents (often stolen or AI-generated).</em></p> <cite>Heiner García Pérez, member of SEAL Intel</cite>
</blockquote>
<p>These fake profiles become real Trojan horses. The KYC system of platforms is no longer a barrier, but a camouflage tool. It’s a war of appearance where the North Korean regime leads the dance.</p>
<h2 id="h-social-engineering-and-human-exploitation-recruiters-with-a-digital-smile">Social Engineering and Human Exploitation: Recruiters with a Digital Smile</h2>
<p>North Korean cunning doesn’t stop at tools. It relies on human weaknesses. Pyongyang agents target vulnerable people: isolated freelancers, Ukrainians in crisis, women seeking economic independence. On forums like InterPals or AbleHere, approaches always start gently: a friendly exchange, a promise of income, a quick test.</p>
<p>Then comes the spiral: identity documents, software like AnyDesk, takeover of the freelance account. The “recruited” become fronts. And the share is clear: 20% for them, 80% for the operator.</p>
<div class="wp-block-image">
 <figure class="aligncenter size-large">
  <img src="https://www.securityalliance.org/_next/image?url=https%3A%2F%2Fseal-news-image-storage.s3.us-east-2.amazonaws.com%2Fimage-1762291243236.png&amp;w=1080&amp;q=75" alt="Screenshot reflecting a sample of messages seen on Interpals">
  <figcaption>
   Sample of messages seen on Interpals – Source: Security Alliance
  </figcaption>
 </figure>
</div>
<p>An internal document found in a hacker’s files indicates a quasi-military organization: contact scripts, onboarding procedures, explanatory PowerPoint. Fraud becomes a digital subcontracting business.</p>
<p>The crypto community, which relies on decentralization, is the perfect prey. Digital wallets are accessible, crypto freelancers are numerous, identities circulate.</p>
<p>Behind this system, a chilling truth: Pyongyang exploits individuals to deceive others. And all this under a friendly, benevolent, almost engaging mask.</p>
<div class="my-4">
 <div class="ads ">
 </div>
</div>
<h2 id="h-opaque-networks-crypto-and-ai-pyongyang-s-business-plan">Opaque Networks, Crypto, and AI: Pyongyang’s Business Plan</h2>
<p>What North Korea has set up amounts to an industrial plan. Payments pass through freelance platforms to bank accounts or crypto wallets held by “proxies.” Then, funds are repatriated in the form of crypto-assets to Pyongyang or its accomplices.</p>
<div class="affiliate-button">
 <a href="https://www.financeads.net/tc.php?t=72846C386875220T" target="_blank" rel="noopener noreferrer nofollow">Start your crypto adventure safely with Coinhouse</a> <a href="https://www.cointribune.com/en/sponsored-content/" target="_blank" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<p>AI still plays a role here: generated profiles, simulated activity histories, fake Zoom calls to validate identities. Recruiters sometimes ask their collaborators to enroll their circle, forming a pyramid network hard to trace.</p>
<p>The crypto sphere becomes the ideal channel for these invisible flows: no bank, no regulator, no customs.</p>
<h3 id="h-visual-summary-of-key-facts">Visual Summary of Key Facts:</h3>
<ul>
 <li>More than 300 developers targeted since 2024;</li>
 <li>Payment redistributed according to a rule: 80% operator / 20% proxy;</li>
 <li>Infiltrated platforms: Upwork, Freelancer, GitHub…;</li>
 <li>Massive use of AI for identity theft;&nbsp;</li>
 <li>Widespread malware: BeaverTail, InvisibleFerret.</li>
</ul>
<p>This model works because it mixes technology and psychological manipulation, with formidable effectiveness. Platforms, often overwhelmed, struggle to block these accounts, which reappear under other names, other faces.</p>
<p>North Korean hackers bled the crypto universe dry in 2024. With $1.3 billion siphoned, they signed a record year. Their strategy evolves. Their power too. How far will they go?</p>

A Massive Scam Organized by Pyongyang Hits GitHub, Upwork, and Freelancer

Table of Contents

Cointribune EN

Other articles published on Nov 6, 2025

Join our free newsletter for daily crypto updates!