UN estimates put annual revenue from North Korea's IT worker schemes as high as $600 million, while Chainalysis uncovered how crypto salaries reached Russian intermediaries.

US authorities sanctioned a crypto cash-out network accused of turning North Korean undercover IT workers' earnings into weapons funding.

The Oct. 28 Treasury action targets 10 individuals and one entity, including two Russian nationals accused of facilitating approximately $5.5 million in cryptocurrency transactions for North Korean operations over different periods.

A separate Chainalysis investigation traced salary payments to an undercover developer who contributed code to blockchain and decentralized finance (DeFi) projects, showing how earnings from legitimate crypto businesses reached Russian financial intermediaries.

North Korean operatives have increasingly used stolen identities, fraudulent documents, and fabricated employment histories to secure remote jobs at legitimate businesses, including cryptocurrency companies.

According to Chainalysis, some workers have also used generative AI to create convincing resumes, generate realistic profile photos, and produce deepfake videos during recruitment interviews.

These techniques allow operatives to conceal their identities and potentially bypass conventional hiring checks, particularly at companies that recruit developers remotely.

Once employed, the workers collect salaries that North Korean authorities allegedly appropriate to support the country's weapons programs.

Chainalysis identified one such operative who contributed code to blockchain projects and DeFi protocols while receiving regular cryptocurrency payments.

The discovery raises security concerns for crypto firms that unknowingly grant disguised operatives access to software repositories and sensitive development infrastructure.

Treasury warned that North Korean IT workers have exploited their corporate access to deploy malware, steal proprietary information, and extract sensitive data.

Source link