North Korea

In a report from Bloomberg, cybersecurity firm Mandiant has claimed that North Korean citizens are plagiarising online resumes and pretending to be from other countries as they attempt to fraudulently obtain remote, freelance employment at crypto firms.

The warning from Mandiant follows a similar alert issued by the US government in May that North Koreans were seeking to infiltrate tech companies for malicious purposes.

Fake Employees Aim to Aid Regime’s Fundraising

According to Mandiant researchers, North Korean citizens have been copying resumes found on professional networking websites such as LinkedIn and Indeed, claiming to have skills relevant to working on crypto projects.

In one case, a suspected North Korean applicant claimed to have published a whitepaper about the Bibox crypto exchange. In another, the applicant claimed to be a senior software developer at a blockchain consultancy firm.

Speaking to Bloomberg, Mandiant principal analyst Joe Dobson said the North Korean applicants were seeking to gain access that allowed them to influence an organisation’s direction:

It comes down to insider threats; if someone gets hired onto a crypto project and they become a core developer, that allows them to influence things, whether for good or not.
Joe Dobson, principal analyst, Mandiant

Fellow Mandiant analyst Michael Barnhart said a central objective for the North Koreans applying for these jobs was to gather insider information on emerging trends in the crypto market, which could allow the North Korean regime to benefit through illicit fundraising efforts to skirt Western sanctions:

These are North Koreans trying to get hired and get to a place where they can funnel money back to the regime.
Michael Barnhart, principal analyst, Mandiant

Mandiant said the North Korean applicants were mainly located in China and Russia, and presented themselves as being South Korean, Japanese and in some cases American.

North Korea’s Troubled History With Crypto

The North Korean regime has used crypto-based crime as a source of revenue for some time. According to Chainalysis, the regime stole almost US$400 million worth of crypto in 2021 alone – a staggering 2.4 percent of the nation’s total GDP.

In April this year, the regime-backed Lazarus hacking group was believed to have been behind the US$625 million hack of the Ronin Network.

In a related story, around the same time former Ethereum developer Virgil Griffith was sentenced to 63 months in prison and fined US$100,000 by a US Federal Court judge for illegally travelling to North Korea in 2019 to teach citizens how they could use crypto to evade US sanctions.

Following Early Support, Seriousness Becomes Clear

Many in the crypto community initially considered the charges against Griffith an overreaction. Ethereum founder Vitalik Buterin, for one, signed an online petition to free Griffith in 2019 and tweeted his support:

I refuse to take the convenient path of throwing Virgil under the bus, because I firmly believe that that would be wrong. I'm signing. Reasoning below.https://t.co/E44p5caeJO
— vitalik.eth (@VitalikButerin) December 1, 2019

However, following a long investigation by the FBI it became clear that Griffith did more than illegally travel to North Korea and speak at a crypto conference – much of the evidence against him showed that he specifically sought to help the North Korean regime escape sanctions using crypto.

Images were uncovered showing Griffith wearing a North Korean military uniform standing next to a whiteboard where he’d drawn a happy face and written the words “No sanctions” and “yay”.

The investigators also found Griffith had shared text messages with North Korean citizens assuring them he’d be able to help them get around US sanctions using crypto, in one message telling them that setting up an Ethereum node in North Korea will “make it possible to avoid sanctions on money transfers”.

North Korea Uses Crypto to Fund Illegal Activities

The actions of Griffith were treated so seriously by US authorities partly because the North Korean regime has been enthusiastic to use stolen crypto to skirt sanctions and fund its illegal weapons programs.

Through government-backed hacker groups such as the Lazarus Group, the North Korean regime steals huge amounts of crypto. According to Chainalysis, in 2021 alone it stole almost US$400 million worth of crypto, which is 2.4 percent of the nation’s total annual GDP.