Fake Crypto Startup Sting Exposes North Korean Fake IT Workers

Security researchers created a fictitious cryptocurrency startup and advertised remote developer positions to investigate infiltration tactics used by North Korean IT operatives. The experiment resulted in the hiring of three suspected North Korean workers, with every company-issued virtual machine secretly recording activity during onboarding and work.

The investigation revealed telling inconsistencies in the applicants' paperwork. One hire claimed to live in Pasadena, Texas, but submitted a California driver's license alongside a New York bank account — a mismatch that would raise red flags for any careful hiring manager. These discrepancies between claimed location, identity documents, and financial details are common indicators used by North Korean operatives who secure remote IT jobs at Western companies, often to generate revenue for the regime or gain access to sensitive systems.

This case highlights a growing threat facing businesses that hire remote workers, particularly in tech and crypto sectors. Australian SMBs increasingly rely on remote and offshore talent, making it essential to scrutinise identity documents, verify addresses against banking details, and confirm consistency across all onboarding paperwork before granting system access.