US, Japan, and South Korea warn web3 firms about hiring IT workers from North Korea

In a joint statement, the United States, Japan and South Korea highlighted the increasing threat to the global crypto sector from North Korean cyber actors.

The United States, Japan and South Korea have warned the blockchain industry about North Korean cyberattacks that could destabilize the global financial system. In a joint press release on January 14, the Japanese government noted that groups such as the Lazarus Group were targeting exchanges and investors to steal cryptocurrencies.

Governments have highlighted North Korean hackers using social engineering tactics such as malware such as TraderTraitor and AppleJeus, and called on web3 companies to review past advice to avoid inadvertently hiring North Korean IT workers. Countries have also encouraged private-public collaboration through initiatives such as Crypto-ISAC in the United States and related efforts in Japan and South Korea, according to the statement.

In 2024 alone, North Korea has been linked to thefts worth millions, including a $308 million hack from Japanese crypto exchange DMM Bitcoin and a $50 million attack on South Korean trading platform Upbit.

At the Cyberwarcon conference held in late November 2024, researchers discovered that many North Korean hackers were posing as remote workers for large companies, including IT employees and recruiters. The investigation also revealed that two hacker groups, Sapphire Sleet and Ruby Sleet, worked for North Korea and stole $10 million in just six months by posing as recruiters or venture capitalists.