ZachXBT: $16.5M in Crypto Sent to North Korean Devs Infiltrating Web3 Projects

In Brief:

Over 345–920 developer roles possibly infiltrated by North Korea

$16.58M in crypto payments tracked since January 2025

Crypto investigator ZachXBT revealed that over $16.58 million in crypto payments have been funneled to North Korean IT personnel posing as developers across multiple blockchain projects this year. His investigation, posted on X, shows a disturbing trend of state-backed infiltration through freelance and contractor roles in the crypto sector.

From January 1 to present, the funds averaged $2.76 million per month, suggesting that up to 920 fake developer accounts—based on estimated monthly salaries of $3,000 to $8,000—may be operating across various companies. ZachXBT monitored six major clusters, one of which included eight confirmed North Korean workers involved in at least 12 different Web3 projects.

The investigation traced these payments to two main aggregate wallet addresses, further pointing to a coordinated effort to exploit the open nature of crypto hiring pipelines. This follows multiple U.S. government warnings about North Korean cyber operations targeting the crypto industry for sanctions evasion and illicit revenue.

‍