Ethereum Foundation helps expose DPRK IT workers across roughly 53 crypto projects

North Korea’s hacking campaign has kept the crypto industry on high alert for years, but the Ethereum Foundation says the momentum could shift within months after the completion of a six-month security effort.

Ethereum Foundation program targets DPRK-linked activity

In a blog post published on Thursday, the Swiss nonprofit said its ETH Rangers Program—run in coordination with blockchain security groups—helped identify around 100 IT workers associated with the Democratic People’s Republic of Korea across 53 crypto projects. The discoveries were made over more than half a year.

The Foundation said the program also detected hundreds of vulnerabilities and triggered dozens of incident responses. It reported the program’s results as “$5.8M+ recovered,” “785+ vulnerabilities reported,” and “100+ DPRK operatives identified,” among other outcomes.

How the effort worked

The Ethereum Foundation said the detections were spearheaded by the Ketman Project, which co-authored a framework for identifying DPRK workers with an organization called the Security Alliance (SEAL). The Foundation described the work as addressing a key operational security threat facing the Ethereum ecosystem.

The program also benefited blockchain sleuth Nick Bax, who the Foundation said identified and notified more than 30 teams that DPRK workers were on their payroll. It added that this helped freeze “hundreds of thousands of dollars” in crypto received by bad actors.

Context: scale of DPRK cyber operations

The Foundation pointed to prior reporting indicating the DPRK has dispatched large numbers of IT workers overseas. It cited a 2023 United Nations report that said the DPRK sends between 3,000 and 10,000 IT workers abroad. It also referenced research published alongside the U.S. State Department suggesting as many as 1,500 are located in China, with plans to send more to Russia.

Recent losses and legal developments

Last year, blockchain analytics firm Chainalysis reported that North Korean hackers stole a record-breaking $2 billion in crypto in 2025, a 51% increase from the previous year. Chainalysis said DPRK workers often infiltrate services to obtain privileged access.

The Foundation also noted that the theft of $285 million in crypto from Drift Protocol this month heightened concerns after the Solana-based decentralized exchange said it had been hit by a months-long social engineering hack attributed to North Korean hackers.

Alongside the security response, U.S. authorities reported criminal cases tied to DPRK-linked infiltration. The Justice Department said two U.S. nationals who helped DPRK workers pose as Americans to gain access to 100 companies were sentenced to at least seven years in prison. Each pleaded guilty to wire fraud and money-laundering conspiracy charges.

Authorities said the individuals received $700,000 for their roles in funneling millions of dollars from victimized U.S. companies overseas. The DOJ added that eight defendants indicted in connection with the scheme remained at large.