North Korean Job Infiltration Scheme Pays $500 Monthly in Crypto, Bitcoin (BTC) Theft Wave Deepens

Third-Country Stand-Ins at the Interview Table

North Korea has widened its fake-employment machine by recruiting remote IT workers in third countries — Iran, Lebanon, Syria, South Africa and Saudi Arabia among them — to sit video interviews with US companies on behalf of DPRK operatives, according to reporting published Friday. Once a foreign stand-in secures the contract, a North Korean operative quietly takes over the actual work. US government agencies and cybersecurity researchers estimate that thousands of DPRK-linked workers have applied to hundreds of American firms, and the tactic has grown more elaborate precisely because US identity screening has tightened. The recruiting itself looks strikingly conventional: operatives scout candidates on LinkedIn, mirroring Western hiring practices, then train some recruits on how to sustain a fabricated identity through onboarding. Compensation details stand out. Analysis of leaked DPRK communications by threat-intelligence firm Flare shows that part-time “interview associates” were offered around $500 per month, paid in digital assets delivered to a crypto wallet address. Flare has traced at least 14 Iranians recruited directly by North Korean IT cells since 2024, and at least two of them passed interviews as substitutes and received formal offers from US employers. A leaked DPRK tracking document also records one operative contacting more than 50 Iranian engineers. Flare researcher Chris Dion argues Iran is an appealing recruiting ground because international sanctions shut most locals out of high-paying foreign work, while the country produces an abundant pool of highly educated STEM graduates.

$2 Billion in Crypto Losses and a Government Alert

The scheme's financial footprint is now large enough that a joint advisory issued in July by the US State and Justice Departments together with several foreign agencies warns that North Korean IT workers “seek out contracts with the intent of remitting their salaries to their parent North Korean agencies,” while also posing insider threats through data exfiltration, cryptocurrency theft and the theft of sensitive information. The remote-work infiltration playbook accelerated after the COVID-19 pandemic normalized distributed hiring. United Nations estimates put the DPRK's revenue from these operations at up to $600 million per year, and a US-led sanctions-monitoring assessment pegged 2024 inflows as high as $800 million — money that supports sanctions evasion and weapons-of-mass-destruction and ballistic-missile programs. The downstream crypto damage is measurable: data from cybersecurity firm CrowdStrike shows North Korea-affiliated hackers and threat actors were involved in more than $2 billion in digital-asset losses in 2025, a 51% year-on-year increase. North Korea's broader economy appears to be absorbing the proceeds — the Bank of Korea estimates DPRK GDP grew 3.5% in 2025 despite global sanctions. Readers tracking the market in real time can follow live spot and futures prices on Binance.

Hiring Pipelines, Not Protocols, Are the Weak Point

Our reading is that this campaign is not a chain-level exploit: no replay attack or signature flaw is involved, and protocol hardening such as SegWit does nothing against a fake employee with legitimate system access. Exchange-side defenses — custody controls, order types, withdrawal screening — likewise cannot flag an insider who was never a real candidate. The primary July advisory makes the core risk explicit: hired operatives remit salaries and exfiltrate data from inside the perimeter. With more than $2 billion in 2025 crypto losses tied to DPRK-affiliated actors, COINOTAG's view is that the deepest liquidity pool in the market — Bitcoin (BTC) — remains the central destination for that stolen value, making identity verification at the hiring stage the industry's most underpriced security control.