North Korean IT Workers Turn Developer Access Into a $900,000 Theft Route

US prosecutors allege that two developers hired under false identities stole more than $900,000 in crypto assets from an Atlanta blockchain research business and a Serbian token company, according to a June 2025 federal indictment announced in Georgia. The workers, hired in 2020 and 2021, allegedly committed the thefts in 2022 — after their employers had already entrusted them with production projects.

The indictment, covered by Crypto.news, describes false and stolen identity information. One alleged theft involved changes to two smart contracts; another exploited access the employer had granted directly. Prosecutors also allege that one worker's recommendation led the Serbian company to hire a second person under an alias. That referral pattern means one fraudulent hire can seed another. The charges remain allegations pending court proceedings.

What does the FBI's October 13 alert add?

The FBI's October 13 warning describes a support network of facilitators who supply identities, host employer-issued devices, and even stand in for interviews. The applicant, the person on camera, and the person doing the work can be three different people. The device itself may sit at a plausible local address while someone operates it remotely through software or external hardware.

A location check on the laptop, in other words, answers nothing about who is typing. The alert also warns that a single indicator is unreliable and that overly aggressive filters can exclude qualified applicants. The agency recommends layered assessment across the entire employment lifecycle instead.

Can the worker pass as competent and still be the threat?

Yes — and that is the core problem. The scheme does not require the worker to fail. Real, useful work generates wages and builds trust, and that trust unlocks repository access, deployment rights, cloud credentials, and eventually payment authority. The alleged Georgia thefts followed exactly that sequence: hiring first, responsibility second, theft last.

A developer who can alter contract logic does not need a wallet seed phrase to redirect funds. Changing an address, a permission check, or a withdrawal condition can determine where value goes while the surrounding code looks ordinary. Standard tests that confirm an application runs can miss a changed payment recipient entirely.

What did Kraken and Google report?

Kraken published an account of a recruitment attempt it stopped before hiring, after industry partners warned the exchange about suspicious applicants. The company reported identity and technical anomalies during the process and investigated rather than treating the interview as self-contained. The case shows the value of shared identifiers — with a caveat: a name or email copied from a victim can create a false match that harms a legitimate person.

Google Threat Intelligence Group's April 2025 report described North Korean IT operations expanding into Europe and increasing extortion using former employers' data. Google's Cloud Threat Horizons report for the first half of 2026 separately documented a North Korean-linked intrusion into a crypto organization that reached cloud systems and financial logic through a compromised endpoint.

Is theft the only revenue route?

No. The Justice Department's June 2025 forfeiture complaint concerned more than $7.74 million allegedly laundered from such employment arrangements — wages collected under false identities, converted to cryptocurrency, and moved onward. Crypto.news also reported a separate stablecoin forfeiture of roughly $212,700, a figure distinct from the larger action. A company can face sanctions and fraud exposure from payroll fraud even if no wallet is ever drained; a treasury audit that finds no missing coins does not clear the books.

What survives offboarding?

Disabling an account stops future use of those credentials. It does not retrieve copied source code, invalidate secrets the person saw, roll back deployed contracts, or revoke tokens and vendor accounts created during employment. Some on-chain changes require separate transactions or governance processes to undo. Crypto.news reported an October case involving alleged American facilitators, a reminder that the network around a single worker can outlast the employment.

The strongest defense, per the FBI, is a record that connects the authorized employee to the work, devices, credentials, and payments that follow — across HR, finance, IT, and management views, since each team sees only a fragment. The charges against the Georgia defendants will test whether that record exists in practice.