Fake DeFi Company, Tools Spotted, and Official Data
Researchers Mauro Eldritch of BCA LTD and Heiner García of NorthScan set up a fake crypto company to observe the work of IT workers they suspect of working for North Korea from the inside. On August 10, 2026, they published the results on the blog of the ANY. RUN platform, which provided the technical infrastructure for the research.
The researchers associate these workers with the Famous Chollima group, which they describe as one of the groups operating within a broader framework known as Lazarus. The nationality and affiliation of these workers have not been independently confirmed, and according to media reports, no government institution has publicly identified the people in this experiment, so it is an estimate by the researchers.
Source: cointelegraph
How a fake company is set up
The researchers set up a fake company, Ballena Azul LTD, presented as a DeFi protocol that works with owners of large amounts of cryptoassets across multiple blockchain networks. Eldritch posed as the co-founder of the company and García as the head of the development team. The company had a website, documentation, and an online presence, and the credibility, according to the researchers, was also contributed by the entry of the company of the same name in the British Register of Companies, which was shut down in 2022 and is not related to their operation.
García came into contact with a recruiter through GitHub, whom the researchers associate with the Famous Cholli group. The recruiter introduced the first programmer to the company, who then recommended the second and the second the third. The three candidates were hired after a job interview and were given assignments in virtual computing environments supervised by researchers, who were able to monitor how they were working for several weeks.
Source: cointelegraph
What the researchers observed
When hiring, the candidates sent U.S. driver’s licenses and bank account information. The metadata of one of the licenses, according to the researchers, shows that the image was processed by Google Gemini and contains SynthID, a watermark that Google uses to mark content created or altered by its AI tools. Because of this and the visible inconsistencies, the researchers deemed this license a forgery, although the watermark itself does not show who created the document. One of the candidates sent a license that reads to another person, and according to the metadata, it is the original photo, which the researchers assume was leaked earlier.
According to the list of tools that the researchers observed in this experiment, the candidates used ChatGPT for writing and programming, including tasks that they did not know how to solve themselves, and Google Gemini to modify images, especially for forging documents. They also used AstrillVPN, tools for remote access to a computer, the 2fa.cn service, through which, according to the researchers, they shared codes for two-factor authentication with each other, and wallets for cryptoassets. These are legitimate tools, and the researchers describe how they were used by the observed candidates.
The researchers also deliberately introduced technical problems, such as network interruptions and the disappearance of the mouse pointer, to see how the candidates reacted. García told the media that the work of the observed candidates relied heavily on improvisation, without a rigid plan and well-established processes. According to media reports, the experiment ended when the fictitious co-founder of the company confronted the candidates with discrepancies in identities and documents, after which the two left the video call.
Source: cointelegraph
Infrastructure used by workers
As an important result, the researchers single out external servers through which candidates connected to the company’s virtual computers. Such infrastructure, they say, is often reused in various operations and can remain active for a long time. García told the media that some of the servers found in previous years were associated with the distribution of InvisibleFerret and BeaverTail/OtterCookie malware, while others were not on the usual lists of blocked addresses.
According to analyses by security companies, these are three separate programs linked to North Korean fake job interview campaigns: BeaverTail and OtterCookie steal access data and data from crypto wallets, and InvisibleFerret allows remote access to an infected computer. The server’s history alone does not show that all of its users belong to the same group.
The researchers warn that such workers do not have to use malware to pose a risk, because after being hired, they gain legitimate access to the company’s internal systems, source code, and other sensitive data.
Source: cointelegraph
What the official data show
On March 12, 2026, the U.S. Treasury Department imposed sanctions on six individuals and two entities for their role in schemes with North Korean IT workers. According to the institution’s estimates, such schemes generate revenues that fund North Korea’s weapons of mass destruction programs, including nearly $800 million in 2024.
On June 30, 2025, the U.S. Department of Justice announced an indictment against four North Korean nationals. According to the indictment, the two men used false and stolen identities to get a job as programmers at an Atlanta-based blockchain company and a Serbian virtual token company, around December 2020 and May 2021, respectively. In February and March 2022, they allegedly stole cryptoassets worth more than $900,000 at the time, which were then laundered through the accounts of the other two defendants. The amount refers to stolen crypto assets, not salaries. The department emphasizes that the indictment contains only charges and that the defendants are presumed innocent until proven otherwise.
On May 6, 2026, the Department of Justice announced that two U.S. citizens had been sentenced to 18 months in prison each in separate proceedings. Both kept company laptops in their homes and installed remote access software on them, so the workers worked from overseas and the companies appeared to be working from the addresses of the convicts in the U.S. According to the Department of Justice, the two separate schemes together generated more than $1.2 million in revenue for North Korea and affected nearly 70 U.S. companies.
Source: cointelegraph
What researchers recommend for companies
The researchers recommend that companies hiring remotely carry out employee identity checks, which would be repeated periodically and include a live check, and additional education of hiring officers to recognize the warning signs.
The FBI’s January 23, 2025 warning also recommends that companies verify identity throughout employment, verify resume information, limit authority to what is necessary for the job, monitor for unusual remote access and code leaks, and report suspicious activity to the authorities.
The experiment provides insight into the behavior of three candidates who were considered suspicious by the researchers, but whose identities and ties to North Korea have not been independently confirmed. The cases of U.S. institutions involve other people and are based on official proceedings, with sanctions, indictments and convictions having different legal statuses.