ZachXBT Accuses ElementalDeFi of employing DPRK IT worker, raising concerns over security risks and sanctions compliance.
Author: Akshat Thakur
Steady attention without excessive speculation.
April 8, 2026– Blockchain investigator ZachXBT accused Solana-based DeFi project ElementalDeFi of employing a North Korean IT worker for several years. Cointelegraph reported the findings on April 7, 2026, after ZachXBT shared a detailed investigation on X.
High Signal Summary For A Quick Glance
Master Sats
@MasterSats
@zachxbt @CR1337 @moothefarmer How does North Korea keep churning out hacking talent and how does North Korea keep them on a tight leash?
@CR1337 @moothefarmer TLDR: DPRK ITWs got caught via OSINT after partying in Laos on New Years a few years back by Chollima Group Source: https://t.co/3VVwfMikgZ https://t.co/6q2VJrzb1J
10:00 AM·Apr 7, 2026
𝘽𝙖𝙡𝙙𝙧 ® 🌐
@Raptorj69
@zachxbt @CR1337 @moothefarmer There's no such thing as Korean hackers. Not everyone is dumb enough to believe this forced narrative
@CR1337 @moothefarmer TLDR: DPRK ITWs got caught via OSINT after partying in Laos on New Years a few years back by Chollima Group Source: https://t.co/3VVwfMikgZ https://t.co/6q2VJrzb1J
08:12 AM·Apr 7, 2026
Naima 🇨🇩 🇺🇬
@Naimaintaipei
@zachxbt @CR1337 @moothefarmer I'm struggling here Zach, So these North Koreans have relatively lax internet access, party in Laos, Cambodia and Thailand and STILL choose communism??
@CR1337 @moothefarmer TLDR: DPRK ITWs got caught via OSINT after partying in Laos on New Years a few years back by Chollima Group Source: https://t.co/3VVwfMikgZ https://t.co/6q2VJrzb1J
07:09 AM·Apr 7, 2026
According to ZachXBT’s findings, the ElementalDeFi DPRK worker operated under a false identity. The operative allegedly served North Korean interests while performing typical engineering tasks on the protocol.
ZachXBT’s investigation relied on open-source intelligence and on-chain analysis. He reportedly identified the individual through employment records, LinkedIn profiles, code contributions, and wallet activity linked to known DPRK patterns.
ElementalDeFi allegedly paid the worker through its development budget for years. During that time, the operative gained access to repositories, internal tools, and potentially sensitive infrastructure.
ZachXBT has previously documented dozens of similar cases. In earlier investigations, he exposed networks that used over 30 fake identities to target crypto firms. As a result, his track record makes him one of the most credible independent on-chain investigators.
North Korean IT workers have targeted the crypto industry for at least seven years. These operatives typically create fake freelance profiles on platforms like Upwork or LinkedIn, complete with stolen or forged credentials.
Once hired, they gain access to codebases, internal communication channels, and sometimes private keys. State-sponsored groups like Lazarus Group direct many of these operations. Their goals include generating foreign currency for the regime and potentially planting backdoors.
DPRK-linked hackers have stolen billions in crypto assets over the past several years. The Bybit hack in February 2025 alone cost the industry over $1.5 billion, according to industry estimates. ZachXBT has described their recruitment tactics as “relentless.”
ElementalDeFi is a Solana-native protocol that offers lending, borrowing, and yield products. Like many smaller DeFi teams, it relied on remote developers and contractors to build and maintain its smart contracts.
This decentralized hiring model prioritizes speed and cost over rigorous vetting. Without centralized HR processes or robust KYC for contractors, projects can unknowingly hire sanctioned individuals. ZachXBT has repeatedly warned the industry about this exact vulnerability.
The multi-year employment suggests a sustained breach of operational security. It raises questions about whether the ElementalDeFi DPRK worker compromised sensitive code, user data, or private keys during that time.
Key milestones in ElementalDeFi and DPRK IT Worker Accusation
ElementalDeFi launches on Solana offering lending, borrowing, and yield products, scaling with a remote-first development model using global contractors.
A North Korean IT worker is allegedly employed under a false identity for years, contributing to core development — aligning with known DPRK crypto infiltration patterns via freelance platforms.
The protocol continues normal operations on Solana, attracting liquidity with competitive yields and showing no public signs of compromise or security issues.
ZachXBT publishes an on-chain and OSINT investigation linking the project to DPRK-linked employment, raising concerns around sanctions, operational security, and potential code risks.
ElementalDeFi has not yet issued a detailed public response. Analysts continue to comb through the project’s on-chain activity and smart contracts, searching for unusual transaction patterns.
The broader Solana DeFi community has reacted with concern. Solana has become a major hub for DeFi innovation, so any perception of lax security could slow institutional adoption. It could also trigger increased regulatory scrutiny of the ecosystem.
Regulatory bodies and sanctions enforcement agencies may also take notice. Employing DPRK nationals can violate international sanctions. If confirmed, the incident could lead to delistings, frozen assets, or legal consequences.
The team will likely conduct an internal audit and issue a formal statement. Independent investigators may review codebases and access logs for signs of compromise.
Users of the protocol should monitor their positions closely. Withdrawing liquidity may be prudent until a thorough security review concludes. This is not financial advice, and users should assess their own risk tolerance.
The incident could prompt other Solana DeFi projects to re-examine hiring practices. Stricter background checks for remote contractors may become standard, especially as the FBI continues to issue warnings about DPRK infiltration.
For now, ZachXBT’s accusation serves as another reminder that sanctions compliance and supply-chain security remain critical in decentralized finance.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
