North Korean Hackers and the $1.4 Billion Crypto Noodle Incident 🍜💸

by

If you were wondering what North Korean IT workers get up to when they’re not updating Kim Jong-un’s MySpace page, the answer is: hacking crypto projects with the subtlety of a herd of stampeding wildebeests, but considerably less grace.

On a perfectly average Wednesday (unless you were one of the hacked), renowned crypto sleuth ZachXBT revealed an exclusive inside peek at the digital misadventures of a North Korean hacker group. This rare glimpse was courtesy of an anonymous whistleblower who did what any daring insider would do-nosed around in their device, probably while muttering, “What’s this button do?”

Turns out, our masked marauders accessed Google resources, VPNs, and a collection of borrowed computers that must have smelled faintly of panic and cheap instant noodles. All these technological wizardries were used to zap themselves around the internet like data-driven teleporters with a flair for secrecy and a mild addiction to Google Translate.

1/ A mysterious informant recently eavesdropped on a DPRK IT worker’s gadget, revealing how five scoundrels shuffled 30+ fake identities-as convincingly as an octopus in a costume shop-using government IDs and professionally purchased Upwork/LinkedIn accounts to sneak into developer jobs.

– ZachXBT (@zachxbt) August 13, 2025

Pretending to Be Someone You’re Definitely Not

The big revelation: these five masters of disguise ran a circus with 31 counterfeit personas, each as plausible as a unicorn piloting a submarine. They cooked up government IDs, conjured phone numbers out of thin air, and shopped for LinkedIn profiles like teenagers on Black Friday.

Deploying their backstories, they landed roles titled “blockchain developer” and “smart contract engineer” at cryptocurrency firms desperate for staff and willing to suspend disbelief. One even survived a full-stack interview at Polygon Labs (where questions like “Are you secretly North Korean?” are clearly not on the checklist), while others added fictional exploits at OpenSea and Chainlink to their gloriously imaginary resumes.

One particularly riveting spreadsheet (yes, really) revealed that they wasted $1,489.8 in a single month on fake accounts, VPNs, computer rentals, and AI subscriptions-proof that hacking isn’t cheap unless you count morals.

The gang coordinated schedules, tasks, and interview scripts primarily in English, which they occasionally massaged with Google Translate, leading to meeting notes so garbled even their own grandmothers couldn’t decipher them. And, for a touch of futuristic espionage, AnyDesk remote access was deployed to work surreptitiously-from a distance, with plausible deniability and questionable internet speeds.

The Not-So-Great Crypto Robbery Network

Are these capers high art? Absolutely not. But, thanks to hiring teams whose vigilance resembles a drowsy sloth, the hacks keep coming. The U.S. Treasury, meanwhile, has flung sanctions at everyone remotely near this merry band-possibly including a few confused bystanders.

By now, this North Korean digital loot fest has pilfered millions, including the $1.4 billion Bybit exchange heist, proving that international crime networks can be just as dysfunctional, weird, and spreadsheet-dependent as, well… any crypto startup.

So don’t be surprised if the next “blockchain engineer” at your office has an unpronounceable name and a suspicious affinity for VPNs. After all, in the world of crypto, “expertise” is only a well-forged LinkedIn account away. 🕵️‍♂️🧑‍💻🚀

Read More

2025-08-14 15:45