ZachXBT Uncovers North Korean IT Worker Network Generating $1 Million Monthly via Crypto

Security researcher ZachXBT exposed a sophisticated North Korean IT worker network operating 390 accounts that generated over $3.5 million in cryptocurrency flows since November 2025, with monthly revenues reaching $1 million. The workers coordinated payments through a shared server secured with the easily-guessed password '123456,' demonstrating poor operational security despite the scale of their operation. The revelation builds on earlier intelligence showing North Korean infiltration of more than 40 DeFi platforms, highlighting systematic efforts by North Korea to generate revenue through cryptocurrency fraud and deception.

ZachXBT's Investigation and Discovery of North Korean IT Worker Network

• ▪ZachXBT uncovered a North Korean IT worker network generating revenue through crypto.

Operational Methods and Security Vulnerabilities

• ▪The password used by North Korean IT workers was described as easy-to-guess.
• ▪North Korean IT workers coordinated crypto payments through a server using a shared password.
• ▪The North Korean IT workers used the password "123456" for their shared server.

Financial Scale and Crypto Payment Coordination

• ▪The North Korean IT worker network generated $1 million monthly.

Perspective of ZachXBT

• ▪ZachXBT's findings follow earlier reports of North Korean infiltration of over 40 DeFi platforms.
• ▪ZachXBT's investigation revealed a 390-account network connected to North Korean IT workers.
• ▪ZachXBT documented over $3.5 million in crypto flows through the North Korean network since November 2025.

Perspective of Cryptocurrency and DeFi platforms

• ▪Over 40 DeFi platforms have been infiltrated by North Korean IT workers according to earlier reports.
• ▪The North Korean IT worker network operated 390 accounts across cryptocurrency platforms.

3 sources