North Korean IT Team Used 30+ Fake IDs to Infiltrate Crypto Firms, Report Reveals

Overview: How a Compromised Device Uncovered a Crypto Hack Ring

An exposed device belonging to a North Korean IT worker has shed light on an organized operation that targeted crypto projects, culminating in the June 2025 exploit of fan-token marketplace Favrr. On-chain investigator ZachXBT traced wallet activity and digital fingerprints from screenshots, Google Drive exports, and Chrome profiles found on the compromised computer. One wallet address, 0x78e1a, was linked directly to funds stolen in the Favrr incident.

Inside the Operation: Fake Identities, Remote Jobs, and Google Tools

The investigation revealed a compact team of six operatives who maintained at least 31 fake identities. To land legitimate-seeming positions in blockchain development, they collected government IDs and phone numbers, and purchased LinkedIn and Upwork accounts to support their cover stories. Interview scripts on the device even claimed prior experience at major projects such as Polygon Labs, OpenSea, and Chainlink.

Workflow Built on Google Services and Remote Access

Google tools were central to their workflow. Drive spreadsheets tracked budgets and schedules, Chrome profiles managed account access, and Google Translate bridged language differences between Korean and English. The device also contained spreadsheets documenting rented computers and payments for VPN services used to create fresh online accounts for operations.

Tools to Mask Location and Control Targets

The group relied on remote access software such as AnyDesk to control client systems without exposing their physical locations. VPN logs indicated the actors routed traffic through multiple regions to mask North Korean IP addresses. These techniques enabled access to code repositories, backend systems, and wallet infrastructure while minimizing attribution risk.

Modus Operandi: Remote Jobs as an Entry Point

Security researchers have repeatedly flagged the tactic of North Korean IT workers securing legitimate remote roles to gain a foothold in the crypto ecosystem. By posing as freelance developers, these actors obtain privileged access to sensitive development environments. Documents found on the device included interview notes and preparation materials likely intended to be kept on-screen during employer calls, underscoring the depth of their social engineering strategy.

Wider Implications for Blockchain Security

Beyond the Favrr hack, the recovered material showed the team researching token deployment across multiple blockchains, scouting AI firms in Europe, and mapping new crypto targets. For exchanges, token marketplaces, and blockchain projects, this case reinforces the importance of strict background checks for remote hires, multi-layered access controls, rigorous code-repository monitoring, and robust wallet security practices to guard against insider-style compromises.

Takeaway

The Favrr exploit and the exposed device illustrate a coordinated, resourceful threat actor leveraging social engineering, purchased identities, and commonplace cloud tools to infiltrate crypto firms. Keeping development access segmented, enforcing strong identity verification, and monitoring for anomalous wallet movements are essential defenses against similar future attacks.