North Korean IT Workers Infiltrate Crypto Sector, Siphon $16.58M in 2025

A concerning trend has emerged in the global tech and cryptocurrency industries as North Korean IT professionals have reportedly funneled over $16.58 million to sanctioned entities in just the first half of 2025. According to blockchain investigator ZachXBT, these operatives, posing as freelance developers, have successfully infiltrated hundreds of cryptocurrency startups and tech projects.

Operating through sophisticated social engineering tactics, the workers bypass standard security protocols to secure sensitive technical positions. Their methods include diverting cryptocurrency payments to wallet addresses linked to entities under international sanctions. Monthly transactions averaging $2.76 million have been recorded, with individual payments ranging between $3,000 to $8,000 per month.

ZachXBT's investigation, shared via Twitter on July 2, 2025, highlights this growing national security concern. The operation demonstrates Pyongyang's continued exploitation of the cryptocurrency sector to circumvent economic sanctions, marking a significant challenge for global compliance teams and cybersecurity professionals.