SEAL Team Member: North Korean Agents Have Infiltrated 15% to 20% of Crypto Firms

On November 24th, as reported by DL News, Pablo Sabbatella, the founder of Web3 audit firm opsek and a member of the Security Alliance (SEAL), disclosed at the Devconnect conference that the extent of North Korean infiltration is much greater than people could imagine. He mentioned that 15% to 20% of cryptocurrency companies have North Korean infiltrators, and 30% to 40% of job applications may come from North Korean operatives trying to gain access. Due to international sanctions, most North Korean operatives cannot apply directly, so they search for remote workers globally, especially those from developing countries like Ukraine and the Philippines, to use as a guise. They ask these workers to hand over their account credentials or allow the operatives to use their identities remotely. The workers receive 20% of the income, while the operatives take 80%. North Korean operatives also recruit Americans as "front-end" individuals. They pose as interviewees from China and pretend not to speak English. They implant malicious software on the interviewee's computer to obtain a U.S. IP address, bypassing restrictions to access more content. Once hired, these operatives, known for their hard work and lack of complaints, are often retained for a long time. To identify them, one can ask about their views on Kim Jong-un, as they are not allowed to speak ill of him. Sabbatella stated that the cryptocurrency industry has weak operational security, and founders are easily victimized by social engineering, and computers are vulnerable to malware.