The Ethereum Foundation said a six-month initiative uncovered around 100 North Korean IT workers embedded across 53 crypto projects, highlighting a significant insider threat to the sector.
The findings come after a record year for North Korean-linked cybercrime, with hackers stealing প্রায় $2 billion in crypto in 2025 and increasingly relying on infiltration tactics to gain privileged access.
“This work directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today,”
Said the Ethereum Foundation.
The foundation said its ETH Rangers Program, developed with blockchain security groups, also identified hundreds of vulnerabilities and triggered dozens of incident responses during the same period.
Investigations supported by the Ketman Project and Security Alliance revealed how DPRK operatives were positioned across dozens of projects, with blockchain analyst Nick Bax helping alert over 30 teams and freeze hundreds of thousands of dollars in illicit funds.
US authorities separately sentenced two individuals to multi-year prison terms for helping North Korean workers pose as Americans to infiltrate more than 100 companies and funnel millions abroad, with payments of about $700,000 tied to the scheme.
The United Nations has previously estimated that between 3,000 and 10,000 North Korean IT workers operate overseas, underscoring the scale of the challenge facing crypto firms as infiltration replaces direct hacking as a primary attack vector.
At the time of reporting, Ethereum price was $2,350.71.