Ketman Project identifies 100 North Korean IT workers working in Web3
The Ketman project, funded by the Ethereum Foundation, identified 100 North Korean IT workers and warned about 53 projects employing DPRK operators.
The Ethereum Foundation has revealed that it funded a six-month project involving 100 North Korean operators who infiltrated Web3 companies under false identities.
The foundation on Thursday shared its ETH Rangers program, which was launched by the end of 2024 to provide “grants to individuals working on the security of public goods” in the ecosystem.
One of the recipients is using the capital to build the Ketman project, which focuses on investigating “fake developers” involved in crypto, particularly operators from North Korea.
Over a six-month payroll period, Ketman's project identified 100 different DPRK IT workers working in Web3 organizations, finding about 53 projects to alert them to the possibility of employing active DPRK operators.
“This work directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today,” the Ethereum Foundation said.
North Korean operators have been troubling the crypto sector, leading to the theft of billions worth of crypto over the years. One of North Korea's most high-profile hacking groups is known as the Lazarus group.
The Ethereum Foundation did not say in detail how the Ketman project was able to identify DPRK operators. But the project's website has extensive text explaining the “tactics, behavior and style of operation” the operators will deploy.
RELATED: CIA Combines AI ‘Coworkers' to Build Intelligence, Catch Spies
They include technical red flags such as reusing avatars and profile metadata across multiple GitHub accounts, accidentally exposing unrelated email addresses during screen sharing, and displaying default language settings such as Russian.
In addition to identifying North Korean operatives, the Ketman Project has developed an open-source detection tool to detect suspicious GitHub activity and developed an industry-standard framework for DPRK IT staff in collaboration with the blockchain-focused non-profit Security Alliance.
Magazine: No one knows if quantum secure encryption even works
