Get the latest crypto news, updates, and reports by subscribing to our free newsletter.
Giấy phép số 4978/GP-TTĐT do Sở Thông tin và Truyền thông Hà Nội cấp ngày 14 tháng 10 năm 2019 / Giấy phép SĐ, BS GP ICP số 2107/GP-TTĐT do Sở TTTT Hà Nội cấp ngày 13/7/2022.
© 2026 Index.vn
North Korea’s hacking campaign has kept the crypto industry on high alert for years, but the Ethereum Foundation says the momentum could shift within months after the completion of a six-month security effort.
In a blog post published on Thursday, the Swiss nonprofit said its ETH Rangers Program—run in coordination with blockchain security groups—helped identify around 100 IT workers associated with the Democratic People’s Republic of Korea across 53 crypto projects. The discoveries were made over more than half a year.
The Foundation said the program also detected hundreds of vulnerabilities and triggered dozens of incident responses. It reported the program’s results as “$5.8M+ recovered,” “785+ vulnerabilities reported,” and “100+ DPRK operatives identified,” among other outcomes.
The Ethereum Foundation said the detections were spearheaded by the Ketman Project, which co-authored a framework for identifying DPRK workers with an organization called the Security Alliance (SEAL). The Foundation described the work as addressing a key operational security threat facing the Ethereum ecosystem.
The program also benefited blockchain sleuth Nick Bax, who the Foundation said identified and notified more than 30 teams that DPRK workers were on their payroll. It added that this helped freeze “hundreds of thousands of dollars” in crypto received by bad actors.
The Foundation pointed to prior reporting indicating the DPRK has dispatched large numbers of IT workers overseas. It cited a 2023 United Nations report that said the DPRK sends between 3,000 and 10,000 IT workers abroad. It also referenced research published alongside the U.S. State Department suggesting as many as 1,500 are located in China, with plans to send more to Russia.
Last year, blockchain analytics firm Chainalysis reported that North Korean hackers stole a record-breaking $2 billion in crypto in 2025, a 51% increase from the previous year. Chainalysis said DPRK workers often infiltrate services to obtain privileged access.
The Foundation also noted that the theft of $285 million in crypto from Drift Protocol this month heightened concerns after the Solana-based decentralized exchange said it had been hit by a months-long social engineering hack attributed to North Korean hackers.
Alongside the security response, U.S. authorities reported criminal cases tied to DPRK-linked infiltration. The Justice Department said two U.S. nationals who helped DPRK workers pose as Americans to gain access to 100 companies were sentenced to at least seven years in prison. Each pleaded guilty to wire fraud and money-laundering conspiracy charges.
Authorities said the individuals received $700,000 for their roles in funneling millions of dollars from victimized U.S. companies overseas. The DOJ added that eight defendants indicted in connection with the scheme remained at large.

Premium gym chains are entering a “golden era” that is ending or already in decline, as rising operating costs collide with shifting consumer preferences toward more flexible, community-based ways to exercise. Long-term memberships are shrinking, margins are pressured by higher rents and facility expenses, and competition from smaller, more personalized…