
Ethereum Foundation research exposes 100 North Korean IT workers infiltrating Web3 firms with fake identities.
Author: Arushi Garg
17 April, 2026: An Ethereum Foundation-funded security research project has identified approximately 100 suspected North Korean IT workers who infiltrated multiple Web3 companies using fabricated identities.
The individuals allegedly posed as legitimate developers and remote contributors from various countries, embedding themselves inside wallets, exchanges, DeFi protocols, and other blockchain organizations. Researchers involved in the investigation described the operation as a “significant nation-state-linked infiltration effort targeting the crypto industry”
High Signal Summary For A Quick Glance
Winthan
@winthanaung
@Cointelegraph Ether has connection with North Korea always, remember last time there was a guy from Ethereum went to DKPR and talk about crypto.
🚨 LATEST: Ethereum Foundation-funded project uncovers 100 North Korean IT workers who had infiltrated Web3 companies under fake identities. https://t.co/9zmC3TH34X
02:06 PM·Apr 17, 2026
Niels
@Web3Niels
@Cointelegraph one hundred identities uncovered. how many more are still inside?
🚨 LATEST: Ethereum Foundation-funded project uncovers 100 North Korean IT workers who had infiltrated Web3 companies under fake identities. https://t.co/9zmC3TH34X
08:23 AM·Apr 17, 2026
Andy Wang
@JustWhaleIt
@Cointelegraph As the industry grows, attacks evolve with it. Not just smarter code, but smarter people behind it.
🚨 LATEST: Ethereum Foundation-funded project uncovers 100 North Korean IT workers who had infiltrated Web3 companies under fake identities. https://t.co/9zmC3TH34X
07:19 AM·Apr 17, 2026
High attention and emotional sentiment detected.
North Korea has deployed remote IT workers globally since at least 2018, according to advisories from the U.S. Treasury and FBI. These individuals often operate under false identities, securing freelance or full-time roles in foreign companies.
Their objectives, as outlined in government reports, include:
Workers typically pose as developers from regions such as Eastern Europe or Southeast Asia, using stolen documentation, fabricated employment histories, and AI-generated profile images.
Timeline: The expansion of North Korea’s IT operations into Web3 and the resulting investigation
North Korea deploys thousands of skilled programmers abroad under fake identities to work remotely, earning foreign currency and stealing intellectual property.
Operatives embed within wallets, exchanges, DeFi protocols, and blockchain infrastructure using fake profiles, deepfakes, and stolen credentials.
A dedicated research initiative uses on-chain tracking, OSINT, and identity verification to investigate suspicious Web3 contributors.
The investigation reveals approximately 100 North Korean IT workers actively operating inside multiple Web3 companies under fake identities.
The research team combined advanced on-chain analysis, identity verification tools, and traditional OSINT (including reverse image searches on AI-generated headshots and voice pattern matching) to unmask the workers. Many of the fake profiles used deepfake photos, cloned voices for interviews, and stolen or fabricated credentials from countries like Russia, Vietnam, and Eastern Europe.
The infiltrated individuals primarily contributed code to open-source repositories, accessed internal tools, and in some cases exfiltrated intellectual property or facilitated crypto laundering. The Ethereum Foundation funded the project specifically to protect the broader ecosystem, as several targeted companies were building critical infrastructure on Ethereum and Layer 2 networks.
The report indicates that suspected operatives were embedded across:
In some cases, individuals had access to internal tooling, codebases, and sensitive workflows. Researchers said they have not identified any confirmed exploits tied directly to this operation so far, but emphasized that insider positioning creates latent risk.
The findings will likely trigger immediate and longer-term changes across the crypto industry. In the near term, companies are likely to conduct internal audits and review contributor access. Hiring pipelines, especially for remote developers, may slow as firms introduce stricter identity verification and background checks.
Over the longer term, the incident could accelerate adoption of:
Regulatory scrutiny may also increase. North Korean cyber operations are already subject to U.S. Treasury OFAC sanctions and UN Security Council resolutions, and this development could expand enforcement focus into employment-based infiltration.
The Ethereum Foundation-backed investigation highlights a structural vulnerability in Web3: human identity remains a weak link in otherwise transparent systems. While no immediate losses have been tied to the infiltration, the scale and sophistication of the operation raise concerns about long-term insider risk.
The research team indicated that additional findings may be released in the coming weeks. The broader industry is now expected to accelerate changes to hiring, verification, and contributor trust frameworks as it responds to the threat.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
Ethereum Foundation Uncovers 100 North Korean IT Workers Infiltrating Web3 Companies
Circle Faces Class-Action Over $230M USDC Loss in Drift Hack
Security researcher finds large-scale fake Ledger wallets on Chinese marketplaces
Rhea Finance Exploited for $7.6M via Fake Token Attack
Ethereum Foundation Uncovers 100 North Korean IT Workers Infiltrating Web3 Companies
Circle Faces Class-Action Over $230M USDC Loss in Drift Hack
Security researcher finds large-scale fake Ledger wallets on Chinese marketplaces
Rhea Finance Exploited for $7.6M via Fake Token Attack