North Korean hackers exploit third-country nationals to infiltrate US companies and acquire cryptocurrency.
TechFlow, September 13 — According to Cointelegraph, North Korea (DPRK) is utilizing remote IT workers from third countries such as Iran and Lebanon to facilitate infiltration into US enterprises, raising funds to support its weapons program. Relevant reports indicate that North Korean intelligence agencies recruit foreign IT workers on LinkedIn as "interview assistants," with some individuals receiving monthly crypto payments of $500 specifically to handle job interviews. Once employment contracts are successfully secured, these positions are typically subsequently filled by North Korean operatives.
Alerts released by the US government and multiple foreign institutions in July this year state that these North Korean IT practitioners have a clear intent to remit their salaries back to their affiliated North Korean organizations, constituting a severe personnel security threat. The reports emphasize that these operatives are deeply involved in data breaches, the theft of sensitive information, and crypto asset theft. Previously, Cointelegraph cited data from cybersecurity firm CrowdStrike showing that, affected by such state-sponsored hacking activities, total crypto asset losses in 2025 have exceeded $2 billion, marking a 51% surge compared to the same period last year.
