Ethereum Foundation Identifies About 100 'Nation-State Level Hackers' Infiltrators with North Korean Background

April 17 — The Ethereum Foundation recently published a summary report on its ETH Rangers Security Project, revealing that over a six-month security funding initiative, researchers identified roughly 100 suspected state-sponsored threat actors—including those linked to North Korea (DPRK)—who have targeted multiple Web3 projects. The report notes the investigation was advanced through efforts like the “Ketman Project,” with researchers issuing warnings to around 53 blockchain projects. These alerts exposed individuals who infiltrated development teams under false identities, holding roles tied to fund flows and technical operations. Additionally, hundreds of thousands of dollars in associated funds have been frozen. The security team also integrated this intelligence into threat analysis systems focused on the Lazarus Group and presented findings at conferences like DEF CON, underscoring that nation-state cyberattacks are increasingly targeting the crypto industry’s infrastructure. In total, the initiative has frozen or recovered over $5.8 million, reported or documented 785+ vulnerabilities, and addressed 36 security incidents. This signals the Ethereum ecosystem’s threats have evolved beyond simple vulnerability exploits to include systemic risks from nation-state actors. Moreover, the report highlights North Korean hackers have infiltrated projects by posing as “remote IT freelancers,” using tactics like account takeovers, freelance platform breaches, and unauthorized fund transfers. These actors are a top focus for industry defenses. The Ethereum Foundation stressed securing decentralized networks requires “decentralized defense” and will continue supporting security research, threat intelligence, and talent development to counter escalating nation-state cyber threats.