North Korean IT operatives posing as remote freelancers have begun infiltrating blockchain projects in the United Kingdom and across Europe, according to a new report from Google’s Threat Intelligence Group (GTIG). The activity marks an expansion of the regime’s cyber operations as it adapts to increased scrutiny in the United States.
In an April 2 report, GTIG adviser Jamie Collier warned that North Korean-linked tech workers have built a sophisticated network of fraudulent online personas, enabling them to blend into international tech and crypto ecosystems with alarming ease.
“In response to heightened awareness of the threat within the United States, they’ve established a global ecosystem of fraudulent personas to enhance operational agility,” Collier said.
The report reveals that North Korean workers have successfully embedded themselves in UK-based blockchain companies, targeting both web development and advanced decentralized technologies.
Some have reportedly worked on projects involving Solana and Anchor smart contract development, while others were discovered in teams building AI web applications and blockchain job marketplaces.
“These individuals pose as legitimate remote workers to infiltrate companies and generate revenue for the regime,” Collier explained.
Fake Resumes, Multiple Identities, and European Focus
The GTIG has documented a surge in North Korean efforts to penetrate European job markets, particularly as U.S. oversight intensifies.
- One individual was found to be using at least 12 different personas to apply for jobs across Europe.
- Fake resumes included credentials from Belgrade University and listed residences in Slovakia, while other operatives sought positions in Germany and Portugal.
- Investigators uncovered login credentials to European job portals, detailed instructions for navigating them, and evidence of a passport forgery broker aiding the operation.
This signals a systematic pivot to European markets as North Korean workers seek to evade U.S. enforcement while maintaining critical funding channels for the regime.
Escalating Tactics: Extortion and Insider Threats
Since late October, GTIG has also observed an increase in extortion attempts targeting former employers.
“Recently fired IT workers threatened to release their former employers’ sensitive data or to provide it to a competitor,” said Collier.
These tactics reflect growing desperation as revenue streams tighten amid international crackdowns and raise new alarms about insider threats and the long-term risks of compromised hires.
In January 2025, the U.S. Justice Department indicted two North Korean nationals for a wide-reaching IT work fraud operation involving at least 64 American companies. Around the same time, the U.S. Treasury’s Office of Foreign Assets Control imposed sanctions on entities accused of funneling revenue to the regime through remote work schemes.
Meanwhile, crypto founders have reported an uptick in sophisticated social engineering attempts, including fake Zoom calls and phishing campaigns designed to extract sensitive information.
In August 2024, blockchain investigator ZachXBT uncovered a network of North Korean developers reportedly earning $500,000 per month by working for “established” crypto projects, often without detection.
An Evolving Threat for the Crypto Industry
As North Korea continues to refine its cyber strategy, industry experts are warning that geographic diversification and social engineering will remain key components of the regime’s playbook.
For blockchain firms, especially those in Europe—the message is clear: vetting, verification, and vigilance are no longer optional. Failure to properly screen talent could open the door to espionage, data loss, reputational damage, and unintentional support for state-sponsored cybercrime.
