Google Uncovers North Korean Infiltration in European Crypto Firms

Source Bitcoinist

North Korean-linked IT workers have reportedly expanded their operations beyond the United States, targeting crypto, blockchain and web development projects in the United Kingdom and Europe, according to a new report from Google’s Threat Intelligence Group (GTIG).

These individuals, operating under false identities, have allegedly embedded themselves into remote crypto, blockchain-related positions in order to generate revenue for the North Korean regime.

Growing Global Infrastructure and Risks for Companies

The increased scrutiny and verification challenges in the US have pushed many of these workers to seek opportunities elsewhere, primarily in Europe. According to GTIG adviser Jamie Collier, the actors have established a global network of fraudulent personas to better navigate international hiring systems.

The report notes that some of these workers have taken roles in blockchain development involving smart contract platforms or crypto networks such as Solana and Anchor, and in projects leveraging artificial intelligence through blockchain integrations.

Collier highlights the existence of facilitators in the UK, supporting the formation of a broader infrastructure that enables continued operations. GTIG’s investigation found North Korean workers had managed to join projects spanning advanced blockchain ecosystems and traditional tech development.

Some individuals reportedly used multiple fake personas across Europe, even presenting credentials from universities such as Belgrade University and claiming residence in countries including Slovakia, Germany, and Portugal.

The fraudulent activity carries significant risks for cypto companies involved. GTIG warns that organizations hiring these workers may face espionage threats, data theft, and internal disruption.

These risks have reportedly escalated since October, with former workers allegedly threatening employers with data leaks if severance conditions were not met. Sensitive proprietary data, including source code, has been cited in these threats.

Fraud Tactics and Recruitment Manipulation

GTIG’s report also uncovered broader evidence of recruitment manipulation, including login credentials for European job portals and detailed instructions for navigating these platforms.

A broker facilitating the use of falsified passports was also identified. Collier emphasized that the campaign appears driven by financial motives tied to the North Korean state, with increased pressure to replace lost US-based income streams.

Notably, with the ongoing diversification of their targets and improved use of international job-seeking strategies, the infiltration of blockchain and crypto firms may continue if left unchecked.

Meanwhile, organizations across Europe and elsewhere seem to already be  taking steps to strengthen identity verification procedures and monitor for unusual activity among remote staff. Collier wrote:

To avoid distributing corporate laptops, some companies operate a bring your own device (BYOD) policy, allowing employees to access company systems through virtual machines. Unlike corporate laptops that can be monitored, personal devices operating under a BYOD policy may lack traditional security and logging tools, making it difficult to track activities and identify potential threats.

The global digital crypto market cap value on TradingView

Featured image created with DALL-E, Chart from TradingView

Disclaimer: For information purposes only. Past performance is not indicative of future results.
placeholder
Gold price falls as markets reposition on Trump’s tariffs, the highest in over 100 yearsGold price (XAU/USD) falls after initially hitting a fresh all-time high at $3,167 in the early Asian session. Traders are starting to take profit, pushing the Bullion price to $3,130 at the time of writing on Thursday.
Author  FXStreet
19 hours ago
Gold price (XAU/USD) falls after initially hitting a fresh all-time high at $3,167 in the early Asian session. Traders are starting to take profit, pushing the Bullion price to $3,130 at the time of writing on Thursday.
placeholder
SOL is the winner as Solana chain turns into battleground for meme coin launchpad and DEXSolana (SOL) gains nearly 2% in the last 24 hours and trades at 118.28 at the time of writing on Thursday. A Decentralized Exchange (DEX) and a meme coin launchpad built on the Solana blockchain have waged a war for users and compete for the trade volume on the chain. 
Author  FXStreet
19 hours ago
Solana (SOL) gains nearly 2% in the last 24 hours and trades at 118.28 at the time of writing on Thursday. A Decentralized Exchange (DEX) and a meme coin launchpad built on the Solana blockchain have waged a war for users and compete for the trade volume on the chain. 
placeholder
Crude oil price today: WTI price bearish at European openingWest Texas Intermediate (WTI) Oil price falls on Thursday, early in the European session.
Author  FXStreet
19 hours ago
West Texas Intermediate (WTI) Oil price falls on Thursday, early in the European session.
placeholder
Gold: Tariff relief for the metal industry – INGGold hit a record high following the announcement of reciprocal tariffs, ING's commodity experts Ewa Manthey and Warren Patterson note.
Author  FXStreet
18 hours ago
Gold hit a record high following the announcement of reciprocal tariffs, ING's commodity experts Ewa Manthey and Warren Patterson note.
placeholder
Silver price today: Silver falls, according to FXStreet dataSilver prices (XAG/USD) fell on Thursday, according to FXStreet data.
Author  FXStreet
18 hours ago
Silver prices (XAG/USD) fell on Thursday, according to FXStreet data.
goTop
quote