--- title: "The North Korean Developers Who Used 31 Fake Identities to Steal $680,000" date: 2025-09-04T14:22:48+00:00 canonical: https://funkyonchain.pages.dev/en/p/내-옆자리-개발자가-북한-해커였다/ original: https://t.me/funkyonchain/2120 publisher: Funkyonchain lang: ko license: CC-BY-4.0 --- # The North Korean Developers Who Used 31 Fake Identities to Steal $680,000 > “The developer sitting next to me was a North Korean hacker” Six operatives, 31 fake identities: The North Korean ghost developers who stole $680,000 from Favrr In 2025, the crypto industry was hit by a series of alarming incidents, particularly the Bybit attack. “The developer sitting next to me was a North Korean hacker” *Six operatives, 31 fake identities: The North Korean ghost developers who stole $680,000 from Favrr* In 2025, the crypto industry was hit by a series of alarming incidents, particularly the Bybit attack. North Korean hackers were not just breaking into servers or sending phishing emails. They were posing as developers, getting hired and stealing from companies as insiders. --- **1. Preparation — 31 fake lives created by six people** The operation involved just six North Korean operatives, but they managed 31 fake identities. - Forged government IDs and phone numbers purchased abroad - Purchased LinkedIn and Upwork accounts used to build out portfolios - Fabricated work histories at global companies including Polygon Labs, OpenSea and Chainlink - English interview scripts, résumés and portfolios prepared in advance The operation was run much like a startup: - Google Drive and spreadsheets for managing work and budgets - Google Translate for real-time English communication - VPNs and AnyDesk to disguise locations as being in the US or Europe - Rented PCs to make it appear that connections originated overseas In May 2025, their recorded monthly expenses came to $1,489.80, including VPN fees, AI tool subscriptions and the cost of maintaining fake accounts. --- **2. Execution — $680,000 disappears from Favrr** The operatives succeeded in getting hired as developers. Once they had internal access, they put their plan into action: 1. Installed a backdoor, giving the hackers a hidden way in and out. 2. Stole private keys, the critical codes used to control crypto wallets. 3. Transferred $680,000 out, disguising the withdrawals as legitimate transactions. 4. Laundered the funds by splitting them up and sending them through mixers to obscure the trail. > Mixers combine and redistribute transactions from multiple users, making them extremely difficult to trace. Onchain analyst ZachXBT traced the wallets and revealed that the incident was an insider operation rather than an external attack. --- **3. Exposure — One laptop revealed the operation** The operation was exposed after a single mistake: one operative’s laptop was hacked in return, revealing hidden files. The files included: - Chrome profiles created for each identity - Screenshots of conversations with real companies - Work shifts and schedules - Expense sheets listing VPNs, AI tools and the cost of maintaining fake accounts The material showed that the North Korean operatives had effectively set up a fake company and worked in an organized fashion. --- **4. The bigger picture — Favrr was only the beginning** The incident was part of a larger pattern: - In 2024, North Korean hackers stole $1.34 billion, accounting for 60% of cryptocurrency theft worldwide. - In February 2025, the North Korean hacking group Lazarus Group stole $1.5 billion worth of ETH from the Bybit exchange. - North Korea deployed about 8,400 IT workers posing as overseas freelancers. - Between 90% and 95% of the proceeds went toward nuclear weapons development and sustaining the regime. According to Reuters, North Korea also set up front companies in the US to deceive overseas developers. --- **5. Conclusion — “Who is my colleague?”** The Favrr incident raised an uncomfortable question for the industry: “What if the remote developer I hired is actually a North Korean operative?” North Korea’s “ghost developers” are no longer just a story from a film. Somewhere today, they may be targeting another Favrr. --- **📌 Reference articles** Cointelegraph: https://cointelegraph.com/explained/how-31-north-korean-developers-fooled-top-crypto-companies-and-stole-680k CoinCentral: https://coincentral.com/how-zachxbt-uncovered-the-680k-north-korean-crypto-scam FX Leaders: https://www.fxleaders.com/news/2025/08/14/north-korean-hackers-used-31-fake-ids-to-steal-680k-from-crypto-firms CoinStats: https://coinstats.app/news/52182d8848d5ff5932aa0bc222b2cbc01e27fb7307c0e3223898fd1acb7d3d63_Leaked-Files-Reveal-North-Korean-Hackers-with-30%2B-Fake-Identities-in-Crypto-Job-Scam The Week: https://theweek.com/tech/hermit-kingdom-it-remote-workers-north-korea Reuters: https://www.reuters.com/sustainability/boards-policy-regulation/north-korean-cyber-spies-created-us-firms-dupe-crypto-developers-2025-04-24 For informational purposes only. Not financial advice. Invest at your own risk. --- 출처 / Source: Funkyonchain — https://funkyonchain.pages.dev/en/p/내-옆자리-개발자가-북한-해커였다/ 원문 / Original Telegram post: https://t.me/funkyonchain/2120