Shift

DeFi

Security

<ul>
 <li>North Korean operatives secretly entered Web3 firms using convincing fake identities</li>
 <li>Security probe uncovers widespread infiltration affecting dozens of crypto projects globally</li>
 <li>Weak hiring checks expose crypto companies to hidden internal cybersecurity threats</li>
</ul>
A covert cyber infiltration campaign has exposed significant weaknesses across the Web3 sector, after investigators uncovered a network of foreign operatives embedded within dozens of crypto projects. The findings reveal how attackers bypassed hiring checks and gained access to sensitive systems, raising urgent concerns about internal security practices across decentralized organizations. 
<a href="https://x.com/solidintel_x/status/2045052565285404684" rel="noopener noreferrer nofollow">According to research backed by Ethereum Foundation</a>, nearly 100 individuals linked to North Korea secured roles in at least 53 crypto and Web3 firms. These individuals reportedly used fabricated identities to pass recruitment processes and integrate into development teams without triggering suspicion. 
The investigation, conducted over six months under the ETH Rangers program, highlighted how remote hiring structures created an entry point for infiltration. Moreover, the probe was led by the Ketman Project, a group focused on identifying deceptive digital identities and abnormal developer behavior patterns. Researchers contacted affected companies directly, warning them about potential internal risks. 
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
 INTEL: Ethereum Foundation funded investigators uncovered 100 North Korean IT workers infiltrating Web3 firms under false identities <a href="https://t.co/OPDCRVJE7N" rel="noopener noreferrer nofollow">pic.twitter.com/OPDCRVJE7N</a> 
 — Solid Intel <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f4e1.png" alt="📡"> (@solidintel_x) <a href="https://twitter.com/solidintel_x/status/2045052565285404684?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">April 17, 2026</a> 
 </blockquote>
</div>
Also Read: <a href="https://36crypto.com/bitcoin-miners-shift-to-ai-as-security-debate-intensifies-across-network/" rel="noopener noreferrer nofollow">Bitcoin Miners Shift to AI as Security Debate Intensifies Across Network</a> 
<h2 id="remote-hiring-loopholes-expose-crypto-firms-to-hidden-threats">Remote Hiring Loopholes Expose Crypto Firms to Hidden Threats</h2>
The operatives built convincing professional profiles across platforms like GitHub and freelance marketplaces, allowing them to pass technical interviews and onboarding processes successfully. Consequently, they gained direct access to internal codebases, financial tools, and operational systems. Besides that, Web3 companies often prioritize speed and global talent access, which can reduce strict identity verification standards. This structure allowed attackers to blend in while performing routine tasks, making detection significantly more difficult. 
Additionally, the <a href="https://36crypto.com/ethereum-foundation-dumps-5000-eth-but-signals-hidden-growth-strategy-ahead-now/" rel="noopener noreferrer nofollow">ETH Rangers initiative</a> uncovered broader security gaps beyond infiltration cases. The program identified over 785 vulnerabilities within crypto systems and helped recover or freeze more than $5.8 million in assets. It also conducted several incident response operations and reached over 209,000 individuals through awareness campaigns. North Korea has maintained a long-standing focus on cyber operations targeting digital assets. Groups such as Lazarus Group have previously been linked to major crypto exploits involving millions of dollars. These operations often aim to bypass sanctions and fund state-backed initiatives. 
Furthermore, experts note that many Web3 projects lack centralized oversight and mature security frameworks. As a result, attackers can exploit these structural gaps while operating undetected for extended periods. The discovery highlights how internal security risks now rival external threats in the crypto sector. Companies may need stricter identity verification and monitoring systems to reduce exposure to similar infiltration attempts. 
Also Read: <a href="https://36crypto.com/xrp-goes-live-on-solana-as-cross-chain-liquidity-expands-defi-access/" rel="noopener noreferrer nofollow">XRP Goes Live on Solana as Cross Chain Liquidity Expands DeFi Access</a> 
The post <a href="https://36crypto.com/north-korean-operatives-infiltrate-50-web3-firms-using-fake-identities/" rel="noopener noreferrer nofollow">North Korean Operatives Infiltrate 50+ Web3 Firms Using Fake Identities</a> appeared first on <a href="https://36crypto.com" rel="noopener noreferrer nofollow">36Crypto</a>.

North Korean Operatives Infiltrate 50+ Web3 Firms Using Fake Identities

Table of Contents

36crypto

Other articles published on Apr 17, 2026

Join our free newsletter for daily crypto updates!