Ethereum Foundation Helps Expose North Korean Workers That Infiltrated Crypto Firms

In brief

• The Ethereum Foundation reported that a six-month program helped detect around 100 DPRK IT workers across 53 crypto projects.
• The report follows a record-breaking year for North Korean hackers, who stole around $2 billion worth of crypto in 2025.
• Meanwhile, two individuals that helped DPRK IT workers infiltrate U.S. companies received multi-year prison sentences in the U.S.

North Korea’s hacking spree has kept the crypto industry on high alert for years, but the Ethereum Foundation has indicated that the tide could turn in a matter of months.

Establishing a program with blockchain security groups helped expose around 100 IT workers associated with the Democratic People’s Republic of Korea, the Swiss nonprofit said in a blog post published on Thursday, noting that the discoveries took place over half a year.

The Ethereum Foundation outlined how the ETH Rangers Program also led to the detection of hundreds of vulnerabilities and prompted dozens of incident responses, but the tally of DPRK-linked individuals hints at the scope of the challenge in human terms.

The ETH Rangers Program has wrapped up and the results speak for themselves: $5.8M+ recovered, 785+ vulnerabilities reported, 100+ DPRK operatives identified, and so much more.

A decentralized defence for a decentralized network.

Read the full recap 👇

— EF Ecosystem Support Program (@EF_ESP) April 16, 2026

In 2023, a United Nations report found that the DPRK has dispatched between 3,000 and 10,000 IT workers overseas. Recent numbers published in conjunction with the U.S. State Department found that as many as 1,500 of them were located in China, with plans to send more to Russia.

Research bankrolled by the Ethereum Foundation identified DPRK workers across roughly 53 crypto projects who were committed to helping the so-called Hermit Kingdom pull off its next heist.