Cryptocurrency Industry's Espionage War Escalates: 40% of Job Applicants Allegedly North Korean Agents?
Original Title: North Korean crypto infiltration is much worse than everyone thinks, says SEAL member
Original Author: Pedro Solimano, DL News
Original Translation: Deep Tide TechFlow
North Korean operatives have already infiltrated 15%-20% of crypto companies.
According to a SEAL member, 30%-40% of job applications in the crypto industry may originate from North Korean operatives.
The crypto industry has been criticized for having "the worst operational security (opsec) in the entire computer industry," said Pablo Sabbatella.
The extent of North Korea's infiltration into the crypto industry is far beyond people's awareness.
Pablo Sabbatella, founder of the Web3 audit company Opsek and current Security Alliance member, dropped a bombshell at the Devconnect conference in Buenos Aires: North Korean operatives may have infiltrated up to 20% of crypto companies.
"The situation in North Korea is much worse than everyone imagines," Sabbatella told DL News in an interview. He even shockingly pointed out that 30%-40% of job applications in the crypto industry may come from North Korean operatives trying to infiltrate relevant organizations in this way.
If these estimates are true, their potential for disruption would be incredibly high.
More importantly, North Korea's infiltration is not just about stealing funds through hacking techniques, although they have already stolen billions through sophisticated malware and social engineering tactics. The bigger issue is that these operatives will be hired by legitimate companies, gain system permissions, and manipulate the infrastructure supporting major crypto companies.
According to a report from the U.S. Treasury Department in November of last year, North Korean hackers have stolen over $3 billion in cryptocurrency over the past three years. These funds were subsequently used to support Pyongyang's nuclear weapons program.
How Do North Korean Operatives Infiltrate the Crypto Industry?
North Korean workers typically do not directly apply for positions because international sanctions prevent them from participating in the recruitment process under their true identities.
On the contrary, they will seek uninformed global remote workers to act as "agents." Some of these agents have even transitioned into recruiters, helping North Korean operatives use stolen identities to hire more overseas collaborators.
According to a recent report by Security Alliance, these recruiters reach out to individuals worldwide through freelance platforms (such as Upwork and Freelancer), with a focus mainly on Ukraine, the Philippines, and other developing countries.
Their "transaction" is quite simple: they provide verified account credentials or allow North Korean operatives to remotely use your identity. In return, collaborators can receive 20% of the income, while the North Korean operatives retain 80%.
Sabbatella stated that many North Korean hackers target the United States.
"Their approach is to find Americans to be their 'front end,'" Sabbatella explained, "They will pretend to be from China, unable to speak English, needing someone to help with interviews."
They will then infect the "front end" individual's computer with malware to obtain a US IP address, allowing them to access more internet resources than when in North Korea.
Once hired, these hackers are usually not dismissed because their performance satisfies the company.
"They are highly efficient, work long hours, and never complain," Sabbatella said in an interview with DL News.
Sabbatella provided a simple test method: "Ask them if they think Kim Jong Un is weird or has any flaws." He said, "They are not allowed to say anything negative."
Operational Security Vulnerabilities
However, North Korea's success does not solely rely on sophisticated social engineering.
Cryptocurrency companies—and users—have made it all easier.
"The cryptocurrency industry may be the worst in operational security (opsec) in the entire computer industry," Sabbatella said. He criticized that the founders of cryptocurrency companies are "fully doxxed, perform poorly in protecting private keys, and are easily susceptible to social engineering."
Operational Security (OPSEC) is a systematic process used to identify and protect key information from adversary threats.
The lack of operational security can lead to a high-risk environment. "Almost everyone's computer will be infected with malware at least once in their lifetime," Sabbatella said.
Update Statement
Update: This article has been updated to reflect Sabbatella's clarification that North Korea does not control 30%-40% of crypto applications; this percentage actually refers to the proportion of North Korean operatives in crypto industry job applications.
You may also like

Tom Lee's Ethereum Thesis: Why the Man Who Called the Last Cycle Is Doubling Down on Bitmine
Tom Lee is emerging as one of Ethereum’s most influential supporters. From Fundstrat to Bitmine, his Ethereum thesis combines staking yield, treasury accumulation, and long-term network value. Here is why “Tom Lee Ethereum” has become one of crypto’s most watched narratives.

Naval personally takes the stage: The historic collision between ordinary people and venture capital

a16z Crypto: 9 Charts to Understand the Evolution Trends of Stablecoins

Refutation of Yang Haipo's "The End of Cryptocurrency"

Can a hairdryer earn $34,000? Interpreting the reflexivity paradox of prediction markets

6MV Founder: In 2026, the "landmark turning point" for crypto investment has arrived

Abraxas Capital Mints $2.89 Billion USDT: Liquidity Boost or Just More Stablecoin Arbitrage?
Abraxas Capital just received $2.89 billion in freshly minted USDT from Tether. Is this a bullish liquidity injection for crypto markets, or is it business as usual for a stablecoin arbitrage giant? We analyze the data and the likely impact on Bitcoin, altcoins, and DeFi.

A VC from the Crypto world said AI is too crazy, and they are very conservative

The Evolutionary History of Contract Algorithms: A Decade of Perpetual Contracts, the Curtain Has Yet to Fall

Kicked out by PayPal, Musk aims to make a comeback in the cryptocurrency market

Solana ETF News: What Is a Solana ETF and Why Is Goldman Sachs Betting $108 Million on SOL?
Solana ETF news today shows Goldman Sachs disclosed a $108M position while total SOL ETF inflows reached $1.45B. Analysts now expect up to $6B in institutional demand as Solana trades 71% below its all-time high.

Bitcoin ETF News Today: $2.1B Inflows Signal Strong Institutional Demand for BTC
Bitcoin ETFs news recorded $2.1B inflows over 8 consecutive days, marking one of the strongest recent accumulation streaks. Here’s what the latest Bitcoin ETF news means for BTC price and whether the $80K breakout level is next.

Michael Saylor: Winter is Over – Is He Right? 5 Key Data Points (2026)
Michael Saylor tweeted yesterday “Winter‘s Over.” It is short. It is bold. And it has the crypto world talking.
But is he right? Or is this just another CEO pumping his bags?
Let us look at the data. Let us be neutral. Let us see if the ice has really melted.

WEEX Bubbles App Now Live Visualizes the Crypto Market at a Glance
WEEX Bubbles is a standalone app designed to help users quickly understand complex crypto market movements through an intuitive bubble visualization.

Polygon co-founder Sandeep: Writing after the chain bridge chain explosion

Major Upgrade on Web: 10+ Advanced Chart Styles for Deeper Market Insights
To deliver more powerful and professional analysis tools, WEEX has rolled out a major upgrade to its web trading charts—now supporting up to 14 advanced chart styles.

Morning Report | Aethir secures a $260 million enterprise contract with Axe Compute; New Fire Technology acquires Avenir Group's trading team; Polymarket's trading volume surpassed by Kalshi

Why a Million-Follower Crypto KOL Chooses WEEX VIP?
Discover why top crypto KOL Carl Moon partnered with WEEX. Explore the WEEX VIP ecosystem, 1,000 BTC protection fund, and exclusive rewards for serious traders.
Tom Lee's Ethereum Thesis: Why the Man Who Called the Last Cycle Is Doubling Down on Bitmine
Tom Lee is emerging as one of Ethereum’s most influential supporters. From Fundstrat to Bitmine, his Ethereum thesis combines staking yield, treasury accumulation, and long-term network value. Here is why “Tom Lee Ethereum” has become one of crypto’s most watched narratives.






