Drift

DeFi

ZachXBT

Ronin

Security

<p>North Korean-linked operators have spent years quietly integrating into crypto firms and DeFi teams, raising fresh concerns about insider risk after a string of high-value exploits tied to the country’s cyber apparatus.</p><div id="cn-block-summary-block_0d6f737034bc749405ab9b8f4bcc8aae" class="cn-block-summary"><div class="cn-block-summary__nav tabs"><span class="tabs__item is-selected">Summary</span></div><div class="cn-block-summary__content"><ul class="wp-block-list"><li>North Korean-linked developers have worked inside more than 40 DeFi projects over the past seven years, according to a security researcher.</li><li>Investigators and industry participants warn that many infiltration attempts rely on simple but persistent tactics through hiring channels and social engineering.</li></ul></div></div><p>Security researcher and MetaMask developer Taylor Monahan <a href="https://x.com/tayvano_/status/2040668973923189123" rel="noopener noreferrer nofollow">said</a> these tactics stretch back to the early days of decentralized finance, with individuals tied to the Democratic People’s Republic of Korea contributing to several widely used protocols.&nbsp;</p><p>“Lots of DPRK IT workers built the protocols you know and love, all the way back to DeFi summer,” she said on Sunday, adding that more than 40 platforms, including several well-known projects, have at some point relied on such developers.</p><p>However, she noted that the “seven years of blockchain dev experience” listed on their resumes is “not a lie.”</p><p>You might also like: <a href="https://crypto.news/circle-faces-heat-from-zachxbt-over-inaction/" rel="noopener noreferrer nofollow"> Circle Faces Heat From ZachXBT Over Inaction During $285M Drift Hack </a></p><p>Investigators have long tied North Korea’s cyber operations to the Lazarus Group, a state-backed collective believed to have stolen around $7 billion in digital assets since 2017, according to R3ACH analysts.&nbsp;</p><p>The group has been <a href="https://crypto.news/lazarus-group-suspected-in-bitrefill-hack-that-compromised-hot-wallets/" rel="noopener noreferrer nofollow">associated</a> with some of the industry’s largest breaches, including the $625 million Ronin Bridge exploit in 2022, the $235 million WazirX hack in 2024, and the $1.4 billion <a href="https://crypto.news/south-korea-links-30m-upbit-hack-to-north-koreas-lazarus-group/" rel="noopener noreferrer nofollow">Bybit incident in 2025</a>.</p><h1 class="wp-block-heading" id="north-korean-actors-behind-drift-exploit">North Korean actors behind Drift exploit</h1><p>Last week’s <a href="https://crypto.news/drift-links-280m-hack-to-radiant-attackers/" rel="noopener noreferrer nofollow">$280 million exploit</a> of Drift Protocol has drawn renewed scrutiny. The project said it had “medium-high confidence” that a North Korean state-affiliated group was behind the attack, linking the incident to a wider pattern of infiltration and social engineering.</p><p>However, the face-to-face meetings that led up to the breach were not with North Korean nationals, but rather “third party intermediaries” using “fully constructed identities including employment histories, public facing credentials, and professional networks.”</p><p>These profiles included employment histories, public credentials, and active professional networks, allowing them to build trust through in-person interactions before the exploit unfolded.</p><p>Independent blockchain investigator ZachXBT has <a href="https://x.com/zachxbt/status/2040666565503524932" rel="noopener noreferrer nofollow">warned</a> in a recent X post that not all threats tied to North Korea operate at the same level of sophistication.</p><p>“The main issue is that everyone groups them all together when the complexity of threats is different,” he said.</p><p>He described many infiltration attempts as relatively simple, relying on persistence rather than <a href="https://crypto.news/cz-warns-of-ai-deepfakes-as-more-execs-fall-victim-to-lazarus-linked-zoom-hacks/" rel="noopener noreferrer nofollow">technical complexity</a>. Outreach through job postings, LinkedIn, email, Zoom calls, and interview processes remains common.&nbsp;</p><p>“Basic and in no way sophisticated […] the only thing about it is they’re relentless,” he said, adding that teams continuing to fall for such tactics in 2026 risk being seen as negligent.</p><p>Read more: <a href="https://crypto.news/rwanda-central-bank-warns-against-crypto-use-after-bybit-adds-franc-support/" rel="noopener noreferrer nofollow"> Rwanda central bank warns against crypto use after Bybit adds franc support </a></p>

North Korean IT workers operated within DeFi protocols for years, researcher warns

Table of Contents

crypto.news

Other articles published on Apr 6, 2026

GBP/JPY Price Analysis: Pound’s Critical Recovery Stalls at Formidable 211.45 Resistance

BlockDAG, Uniswap, Solana, & Chainlink Are Among the Altcoins to Watch This Month

Aave’s Milestone and the Upcoming Launch of its Innovative V4 Protocol

Bitcoin sees renewed institutional inflows as capital rotates back from gold

Ripple Prime Gains Issuer Ratings on Strong Capital Position, XRP Holdings

Wells Fargo CEO Flags Growing Market Nervousness Over Iran War

Join our free newsletter for daily crypto updates!