{"id":79618,"date":"2026-04-07T07:01:34","date_gmt":"2026-04-07T07:01:34","guid":{"rendered":"https:\/\/dogewisperer.com\/?p=79618"},"modified":"2026-04-07T07:01:34","modified_gmt":"2026-04-07T07:01:34","slug":"north-korean-agents-have-been-inside-defi-for-nearly-a-decade-researcher-says","status":"publish","type":"post","link":"https:\/\/dogewisperer.com\/?p=79618","title":{"rendered":"North Korean Agents Have Been Inside DeFi For Nearly A Decade, Researcher Says"},"content":{"rendered":"
\n

A $280 million exploit against Drift Protocol last week wasn\u2019t just a heist \u2014 it was the latest operation tied to a network of North Korean agents who have quietly worked inside some of crypto\u2019s biggest projects for years.<\/p>\n

Seven Years Of Cover, 40+ Platforms Breached<\/h2>\n

MetaMask developer and security researcher Taylor Monahan said Sunday that North Korean IT workers have been embedded<\/a> inside more than 40 decentralized finance platforms, some of them household names in the crypto space.<\/p>\n

Their infiltration goes back to what the industry calls \u201cDeFi Summer\u201d \u2014 roughly 2020, when decentralized finance exploded in popularity.<\/p>\n

\n

oh god uhhhh like sushi, thorchain, yam, pickle, harvest, reclaim, swing, paid, naos, shezmu, qrolli, saffron, sifu, napier, harmony, blueberry, stabble, onering, elemental, divvy, la token, impermax, kira, cook, fantom, ankr, gamerse, metaplay, spice, beanstalk, deltaprime,\u2026<\/p>\n

\u2014 Tay \"\ud83d\udc96\" (@tayvano_) April 5, 2026<\/a><\/p>\n<\/blockquote>\n

Monahan said the \u201cseven years of blockchain development experience\u201d these workers list on their resumes isn\u2019t fabricated. They actually built the protocols.<\/p>\n

The Lazarus Group \u2014 the name given to North Korea\u2019s state-sponsored cyber operation<\/a> \u2014 has pulled an estimated $7 billion from the crypto industry since 2017.<\/p>\n

\n

Reportedly:<\/p>\n

In 2026 Lazarus made 18 attacks on protocols in 3 months<\/p>\n

Stolen funds are funding \u201cNorth Korea\u2019s Nuclear Weapons\u201d<\/p>\n

It\u2019s the most successful venture fund built on hacks<\/p>\n

Here is the complete attack timeline \"\ud83d\udc47\" https:\/\/t.co\/GuNL4FTCqv<\/a> pic.twitter.com\/7YJzYrTEJj<\/a><\/p>\n

\u2014 jussy (@jussy_world) April 5, 2026<\/a><\/p>\n<\/blockquote>\n

That figure comes from analysts at creator network R3ACH. Major attacks attributed to the group include the $625 million Ronin Bridge breach in 2022, the $235 million WazirX hack in 2024, and the $1.4 billion Bybit theft<\/a> in 2025.<\/p>\n

Not All North Korean \u2014 Third-Party Proxies Now Involved<\/h2>\n

What sets the Drift case apart is who showed up in person. The protocol said that face-to-face meetings connected to the breach were not conducted by North Korean nationals.<\/p>\n

Instead, reports indicate the group used third-party intermediaries \u2014 people with built-out fake identities, fabricated employment histories, and professional networks constructed to pass scrutiny.<\/p>\n

<\/p>\n

\n

Lazarus Group is the collective name for all DPRK state sponsored cyber actors.<\/p>\n

The main issue is everyone groups them all together when the complexity of threats are different.<\/p>\n

Threats via job postings, LinkedIn, email, Zoom, or interviews are basic and in no way\u2026 pic.twitter.com\/NL8Jck5edN<\/a><\/p>\n

\u2014 ZachXBT (@zachxbt) April 5, 2026<\/a><\/p>\n<\/blockquote>\n

Sleuth: Companies That Still Fall For This Are Negligent<\/p>\n

Blockchain investigator ZachXBT pushed back on how the industry discusses these threats, saying not all attack types carry the same weight.<\/p>\n

Recruitment-based schemes \u2014 job postings, LinkedIn outreach, Zoom interviews \u2014 are, in his words, basic. They require no technical sophistication. What makes them effective is sheer persistence.<\/p>\n

\u201cIf you or your team still falls for them in 2026, you\u2019re very likely negligent,\u201d ZachXBT wrote.<\/p>\n

For companies looking to screen out bad actors, the US Office of Foreign Assets Control maintains a public database where crypto businesses can check counterparties against updated sanctions lists and watch for patterns tied to IT worker fraud.<\/p>\n

Featured image from Unsplash, chart from TradingView<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

A $280 million exploit against Drift Protocol last week wasn\u2019t just a heist \u2014 it was the latest operation tied to a network of North Korean agents who have quietly worked inside some of crypto\u2019s biggest projects for years. Seven Years Of Cover, 40+ Platforms Breached MetaMask developer and security researcher Taylor Monahan said Sunday […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[2],"tags":[3,4,5],"class_list":["post-79618","post","type-post","status-publish","format-standard","hentry","category-news","tag-crypto","tag-doge","tag-news"],"_links":{"self":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts\/79618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=79618"}],"version-history":[{"count":0,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts\/79618\/revisions"}],"wp:attachment":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=79618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=79618"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=79618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}