ZachXBT exposes North Korean IT workers operating 30 fake identities across development platforms
Blockchain investigator ZachXBT exposed a sophisticated North Korean IT worker operation that infiltrates Western technology companies through remote development positions.
In an Aug. 13 report, the investigator highlighted that an unnamed source compromised a device belonging to one of five DPRK IT workers, providing unprecedented access to their operational methods.
The team systematically purchased fake social security numbers, Upwork and LinkedIn accounts, phone numbers, and computer rentals to secure developer jobs at various projects.
Google Drive exports and Chrome browser profiles revealed that the workers extensively used Google products to organize team schedules, tasks, and budgets while communicating primarily in English.
Weekly reports from 2025 revealed that team members were struggling with job requirements, with one noting, “I can’t understand job requirement, and don’t know what I need to do,” alongside the directive to “put enough efforts in heart.”
Operational methods and technology stack
The DPRK workers followed a consistent pattern of purchasing Upwork and LinkedIn accounts, buying or renting computers, then using AnyDesk remote access software to conduct work for their employers.
Expense spreadsheets documented purchases of artificial intelligence subscriptions, VPNs, proxies, and other tools needed to maintain their fake identities.
Meeting schedules and scripts were maintained for each fake identity, including detailed personas like “Henry Zhang” with complete backstories and work histories.
The workers used a wallet address to send and receive payments, to which ZachXBT linked multiple fraudulent operations.
The wallet address tied the team to the $680,000 Favrr exploit from June 2025, where the company’s CTO and other developers were revealed as DPRK IT workers using fraudulent documents.
ZachXBT identified the Favrr CTO “Alex Hong” as having a suspicious background with recently deleted LinkedIn profiles and unverifiable work history.
Unsophisticated but persistent
Browser history from the compromised devices showed frequent Google Translate usage with Korean translations while operating from Russian IP addresses.
The evidence confirmed the workers’ North Korean origins despite their sophisticated English communications and Western personas.
ZachXBT noted the main challenge in combating DPRK IT workers stems from a lack of collaboration between services and the private sector, combined with negligence by hiring teams who become defensive when alerted about potential infiltration.
The workers convert earnings from development work into cryptocurrency through Payoneer, with the investigator noting they are “in no way sophisticated but are persistent since there are so many flooding the job market globally for roles.”
The exposure reveals the scale of North Korean infiltration into Western technology companies, with the compromised operation representing just one team among potentially hundreds operating similar schemes across remote development platforms.
The post ZachXBT exposes North Korean IT workers operating 30 fake identities across development platforms appeared first on CryptoSlate.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
CoreWeave Dilemma for Nvidia: Forced to Rescue or Stand By?
As both a shareholder of CoreWeave and its sole GPU supplier, Nvidia now faces a dilemma after the sharp decline in CoreWeave's stock price. If it intervenes, each rescue strengthens expectations of a safety net, raises the threshold for future rescues, and risks getting further entangled in this high-leverage game. If it does not intervene, CoreWeave's liquidity crisis will directly cut off demand for GPU purchases, simultaneously devaluing Nvidia's equity investment and severely damaging its market reputation.
US CPI Heats Up Across the Board, Triggering "Inflation Spiral" Alert; October Rate Hike Odds Once Hit 50%. "New Fed News Agency": Watch Waller's Speech This Week
After the CPI was released, the market-implied rate hike probability first rose to 50% before falling back to 40%. Wall Street generally believes that whether action will be taken in October still depends on how the Federal Reserve assesses inflation trends. "The New Fed News Agency" noted that, unlike in August when price increases were concentrated in certain items, the stronger-than-expected performance of September's core CPI was more broad-based, further reinforcing the case for a December rate hike. The speech by Waller on Friday morning Beijing time is his last public statement before the Fed's blackout period ahead of this month's meeting. Economists are warning about an "inflation spiral," with real purchasing power and midterm election pressures interweaving.
The calm period in the US stock market is over! The S&P 500 ends its record of 53 consecutive trading days without a drop of over 1%. AI stock sell-off intensifies market concerns.
The S&P 500 Index fell by 1.1%, ending a streak of 53 consecutive trading days without a drop of 1% or more. This was the longest period of calm since January 2020.
Federal Reserve Beige Book: U.S. economy expands moderately but inflationary pressures intensify; AI boosts productivity curbing some corporate hiring demand
The latest Beige Book released by the Federal Reserve on Wednesday shows that overall economic activity in the United States continues to grow, but performance varies across regions. Consumer spending remains generally weak, and there has been little change in the labor market.
Crypto prices
More
