North Korean IT Workers Target Crypto Companies Through Remote Jobs

Recent reports from Google Cloud and Wiz reveal that North Korean IT workers are using deceptive remote job offers to infiltrate cryptocurrency firms. These cybercriminals, linked to North Korea's military intelligence, have successfully stolen millions of dollars in digital assets. This article outlines the tactics employed by the threat group known as UNC4899 and highlights notable incidents in the cryptocurrency sector.

Key Takeaways

North Korean IT workers are utilizing fake remote job offers to access cryptocurrency companies.
The threat group, identified as UNC4899, is connected to North Korea's military intelligence and has been active since 2020.
UNC4899 uses social engineering to compromise individuals, convincing them to execute malicious software on their devices.
Noteworthy breaches include a $305 million hack of Japan's DMM Bitcoin and a $1.5 billion theft from Bybit.
The financial impact of UNC4899's operations is significant, with estimates of stolen assets reaching into the billions.
Research suggests that between 345 and 920 North Korean operatives are currently working in the crypto sector, earning considerable salaries.

North Korean IT Workers Using Remote Jobs to Infiltrate Crypto Companies: Report

North Korean Cyber Threats in the Crypto Space

North Korean IT workers have been leveraging false identities to infiltrate cryptocurrency firms and pilfer millions in digital assets, according to cybersecurity researchers from Google Cloud and Wiz. These reports focus on a North Korean cyber threat group, UNC4899, also referred to as TraderTraitor, which has links to the country's military intelligence operations.

Operations of UNC4899

Operating under the Reconnaissance General Bureau, North Korea's primary foreign intelligence office, UNC4899 has been active since at least 2020. The group specifically targets the blockchain and cryptocurrency sectors, employing advanced social engineering techniques and methods tailored to cloud environments.

Google reported two significant incidents involving UNC4899, where attackers compromised employees from organizations using Google Cloud and AWS platforms. In both instances, the hackers posed as freelance recruiters on platforms like LinkedIn or Telegram, successfully convincing their victims to run malicious Docker containers on their work devices. These actions allowed the attackers to install backdoors and downloaders that connected to their controlled infrastructure.

Following these compromises, the group was able to navigate through internal networks, gather user credentials, and locate infrastructure used for cryptocurrency transactions. One notable case involved the disabling of multi-factor authentication (MFA) on a privileged Google Cloud account, allowing UNC4899 to access wallet services and steal crypto worth millions. They cleverly re-enabled MFA post-theft to avoid detection.

In a separate incident involving AWS, attackers utilized stolen access keys but faced hurdles due to the victim's use of temporary credentials and MFA. They managed to circumvent these security measures by stealing session cookies, letting them alter JavaScript files in AWS S3 buckets to reroute crypto wallet interactions to their own addresses, resulting in another multimillion-dollar theft.

The Evolving Tactics of North Korean Hackers

Wiz, another cybersecurity firm, corroborated Google’s findings while providing additional insights into the activities of UNC4899. Experts from Wiz revealed that the group uses several aliases such as Jade Sleet and Slow Pisces. These aliases reference various tactics employed by different North Korean state-backed groups like the Lazarus Group, BlueNoroff, and APT38.

Although UNC4899 has been active since 2020, the introduction of fake job offers became prominent in 2023, with a focus on targeting employees in cryptocurrency exchanges. High-profile breaches attributed to this group include a $305 million attack on Japan’s DMM Bitcoin and a staggering $1.5 billion theft from Bybit in late 2024.

Financial Implications of the Attacks

Both Google and Wiz have indicated that the average financial damage from these incidents is substantial, with UNC4899 reportedly stealing millions of dollars per attack. Broader statistics gathered from private researchers and government sources suggest even higher losses. A report from Chainalysis in 2024 indicated that North Korean hackers stole around $1.34 billion in cryptocurrency that year. More recently, Wiz researchers estimated that North Korea-affiliated actors have drained $1.6 billion in digital assets by the middle of 2025.

Additionally, independent blockchain investigator ZachXBT estimated that between 345 and 920 North Korean operatives have secured employment in the crypto industry, collectively pulling in over $16 million in salaries since the beginning of 2025.

In conclusion, the infiltration of cryptocurrency companies by North Korean IT workers is a serious threat, posing significant risks to the security and integrity of digital assets in the blockchain space. Companies must remain vigilant and strengthen their cybersecurity measures to navigate this evolving landscape of cyber threats.