A group of North Korean IT workers, posing as freelance developers, earned over $3.5 million in cryptocurrency in a few months while attempting to hack crypto projects, according to leaked data. Blockchain investigator ZachXBT revealed they used a shared payment site with sanctioned entities and funneled funds to Chinese bank accounts. Their operation, while lucrative, was deemed less sophisticated than more dangerous state-backed hacking groups.
Leaked data revealed a North Korean IT team, including an individual named Jerry, made roughly $1 million a month. The group of 140 members earned a total of $3.5 million in crypto since late November according to documents shared by blockchain sleuth ZachXBT.
The workers coordinated payments on a website called “luckyguys.site” using a shared password. Users on that platform appeared linked to sanctioned entities like Sobaeksu, Saenal, and Songkwang.
Crypto payments were converted to fiat and sent to Chinese bank accounts via platforms like Payoneer. Tracing wallet addresses revealed links to other known North Korean wallets blacklisted by Tether in December.
North Korean state-backed workers have stolen over $7 billion since 2009, largely from crypto projects. Major attacks include the $1.4 billion hack of crypto exchange Bybit and the $625 million hack of the Ronin bridge.
The exposed group had a leaderboard tracking each worker’s crypto contributions since Dec. 8. Another screenshot showed Jerry used a VPN to apply for developer roles on Indeed.
In an unsent email, Jerry sought a $30-per-hour WordPress specialist position at a Texas company. Identification documents were falsified, with one worker sharing a billing statement with a fake Hong Kong address.
ZachXBT stated these IT workers were less sophisticated than other groups. Groups like AppleJeus and TraderTraitor “operate far more efficiently and present the greatest risks to the industry.”
