Here’s how North Korean “IT workers” tricked their crypto employers

Last updated: 1 July 2025

Linas Kmieliauskas
Contributor

Crypto stealing North Korea — By Cybernews

As US law enforcement announced charges against four North Korean "IT workers," more details have emerged on how the suspected crypto thieves operated.

In the US, Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam have been accused of stealing and laundering more than $900,000 in crypto assets after tricking their employers into hiring them.

Here's how it all went, according to the US attorneys and the FBI.

In 2019, North Korean operatives moved to the United Arab Emirates and, in the following years, used false identities to get hired as developers by an undisclosed Atlanta, Georgia-based blockchain research and development company, as well as a Serbian virtual token company.

FBI announcement about North Korean IT workers — The FBI and the U.S. Department of Justice announced nationwide actions to disrupt North Korean schemes to defraud American companies through remote IT work. These actions included the arrest of a U.S. national who allegedly hosted a laptop farm for North Korean actors.The North Korean government has dispatched thousands of skilled IT workers around the world, including to China and Russia, with the aim of deceiving U.S. and other businesses into hiring them as remote workers to generate revenue for the regime. These schemes typically involve the use of stolen identities and pose a serious threat to sensitive business information.

At first, two of them were hired, while another "operative" joined the Serbian company later on a recommendation from the previously hired North Korean.

Next, once trust within the company was established, two suspects started working on projects that gave them access to their employers' crypto assets. As a result, in February 2022, Jong Pong Ju allegedly stole crypto, which was worth approximately $175,000, while in March 2022, Kim Kwang Jin modified his employer's smart contracts and stole around $740,000 in crypto assets.

Fraudulent remote IT workers from North Korea — Four North Korean nationals, Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il, who have been charged in a five-count wire fraud and money laundering indictment, are seen on an FBI wanted poster released June 30, 2025. FBI/Handout via REUTERS

According to law enforcement, while three North Koreans were hired, the fourth defendant helped them launder the funds after they were cleaned via a crypto mixer and sent to a crypto exchange. The attorneys said accounts were opened using fraudulent Malaysian identification documents.

"To generate revenue for the regime, the Democratic People’s Republic of Korea dispatches thousands of skilled IT workers around the world to deceive and infiltrate American companies," the announcement concluded.

In related news, the Spanish Guardia Civil, with the support of Europol and law enforcement from Estonia, France, and the US, said it has arrested five members of a criminal network engaged in a €460 million crypto investment fraud that had over 5,000 victims around the world.

Get our latest stories today on Google News

Share

Post

Share