The crypto sector has been vigilant against North Korea’s persistent hacking activities for years, but a recent initiative by the Ethereum Foundation suggests a potential shift in this ongoing battle. In collaboration with blockchain security entities, the foundation revealed approximately 100 IT workers linked to the Democratic People’s Republic of Korea through a blog post published on Thursday, summarizing findings over six months.
The ETH Rangers Program, as detailed by the Swiss nonprofit, not only identified these individuals but also discovered hundreds of vulnerabilities and initiated numerous incident responses. This highlights the significant human aspect of the challenge faced by the industry.
Concluding with substantial achievements, the program reported recovering over $5.8 million, identifying 785+ vulnerabilities, and recognizing more than 100 DPRK operatives among its outcomes.
A decentralized defense strategy was employed for a decentralized network.
— EF Ecosystem Support Program (@EF_ESP) April 16, 2026
A United Nations report in 2023 estimated that between 3,000 and 10,000 IT workers from the DPRK had been deployed overseas. Recent data from the U.S. State Department indicated around 1,500 of them were situated in China, with plans to expand their presence to Russia.
Research funded by the Ethereum Foundation pinpointed DPRK-affiliated individuals across approximately 53 crypto projects, who were allegedly aiding the Hermit Kingdom’s illicit activities.
These findings were primarily driven by the Ketman Project and collaborated with an organization known as the Security Alliance (SEAL) to develop a framework for identifying DPRK workers. “This work directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today,” stated the Foundation.
The ETH Rangers Program also assisted blockchain investigator Nick Bax, who alerted over 30 teams about having DPRK operatives on their payroll and contributed to freezing hundreds of thousands of dollars intended for malicious purposes.
Chainalysis reported last year that North Korean hackers had stolen a record $2 billion in crypto, marking a 51% increase from the previous year. These workers often infiltrate systems to gain unauthorized access, as noted by the firm.
This month’s theft of $285 million from Drift Protocol intensified concerns after the Solana-based decentralized exchange concluded that it was compromised through an elaborate social engineering hack orchestrated by North Korean agents.
Coinciding with North Korea’s celebration of Kim Il Sung’s birthday on Wednesday, U.S. authorities dealt a blow to DPRK associates in America. The Justice Department announced that two U.S. nationals aiding DPRK workers in posing as Americans were sentenced to at least seven years in prison for wire fraud and money-laundering conspiracy. Each received $700,000 for their involvement in funneling millions from victimized American companies abroad.
The DOJ also mentioned that eight additional defendants linked to the scheme are still at large.