Crypto News
The Ethereum Foundation funded a six-month project that has identified 100 North Korean IT workers operating under false identities inside Web3 organizations. The foundation disclosed the results on Thursday as part of a recap of its ETH Rangers program, launched in late 2024 to provide stipends for individuals conducting public goods security work within the ecosystem.
One stipend recipient used the funding to build the Ketman Project, an initiative focused on investigating fraudulent developers embedded in crypto, with a particular emphasis on operatives linked to the Democratic People’s Republic of Korea (DPRK). During the stipend period, the Ketman Project identified 100 DPRK IT workers active within Web3 organizations and alerted approximately 53 projects that may have unknowingly employed them.
The Ethereum Foundation said the work “directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today.” The foundation did not disclose the specific methods used to identify the operatives, but the Ketman Project’s website details the behavioral and technical patterns the team tracked.
Documented red flags include reusing avatars and profile
Documented red flags include reusing avatars and profile metadata across multiple GitHub accounts, accidentally exposing unlinked email addresses during screen sharing, and displaying device language settings, such as Russian, that contradict a claimed nationality. These patterns formed the basis of the project’s investigative methodology.
Beyond profiling individual operatives, the Ketman Project developed an open-It also co-authored an industry-standard identification framework in partnership with the Security Alliance, a blockchain-focused nonprofit organization
North Korean operatives have been linked to billions of dollars in cryptocurrency theft, with state-affiliated groups such as the Lazarus Group among the most widely tracked actors in the sector. The Ketman Project’s findings target the infiltration layer of DPRK operations, which frequently precede or enable financial exploitation.
This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.
