CoinTelegraph
Researchers who built a fake crypto startup from scratch spent several weeks luring suspected North Korean IT workers through the standard remote-hiring funnel, and Cointelegraph joined the sting as a covert VC on the call list.
Heiner García, Mauro Eldritch and the ANYRUN team built the company as a plausible Series A-stage project. When suspected workers came pitching, a Cointelegraph reporter sat in as the investor, ran the diligence questions, and dangled media coverage as part of a potential deal. None of the candidates appeared to realise who they were actually pitching.
Why it matters
The DPRK has spent years turning remote crypto hiring into a sanctions-evasion pipeline. Operatives ship legitimate code during the day and route salary back to the regime, with US Treasury and UN panels repeatedly linking the wages to the country's weapons programmes. Documenting the social-engineering playbook is one of the few public defences the rest of the industry has, because the workers themselves only become visible when someone sets the trap.
Market impact
The sting lands in the middle of a hiring pullback that has already pushed crypto founders toward faster, less rigorous interview cycles. Venture teams running lighter diligence on remote candidates are the most exposed, and the report is likely to be cited as a checklist item in KYC-style hiring reviews across the sector.
Frequently asked questions
-
Who built the fake startup that lured the suspected North Korean IT workers?
Researchers Heiner García and Mauro Eldritch, working with the ANYRUN app team, built the fake startup as a plausible Series A-stage crypto project. Cointelegraph joined as a covert participant during the pitch calls.
-
How did Cointelegraph participate in the sting operation?
A Cointelegraph reporter posed as a venture capitalist on the call list, ran diligence questions, and dangled the magazine's coverage as part of a potential deal. None of the candidates appeared to realise the trap.
-
Why is North Korean IT worker infiltration a concern for crypto companies?
US Treasury and UN panels have repeatedly linked salaries earned by these operatives to the DPRK's weapons programmes. Operatives ship legitimate code while routing wages back to the regime.
-
What red flags help identify suspected North Korean IT workers during remote hiring?
The sting documented familiar signals including resume inconsistencies, reluctance to appear on camera, AI-assisted interview responses, and preferences for stablecoin or overseas-entity payments.
-
Could this sting change how crypto startups run remote hiring?
The report is likely to be cited as a checklist item in KYC-style hiring reviews across the sector. With founders already cutting interview cycles, expect slower but more rigorous remote-hiring protocols to become the new baseline.
TheBlock
CryptoSlate
CoinDesk
Lookonchain