A group of North Korean IT workers has reportedly generated over $3.5 million in just a few months by posing as legitimate developers while secretly targeting crypto projects. According to findings shared by ZachXBT, one operator known as “Jerry” was part of a 140-person network earning up to $1 million per month through fraudulent employment and coordinated crypto payments.

The operation used weak security practices, including shared credentials and centralized payment tracking, while funneling funds through platforms like Payoneer into Chinese bank accounts. The exposed wallets were also linked to previously blacklisted addresses, highlighting ongoing efforts by North Korean-linked actors to exploit the crypto ecosystem for funding.