Ethereum Foundation-Funded Program Exposes 100 North Korean IT Workers Across 53 Crypto Projects

The Ketman Project, funded by the Ethereum Foundation's ETH Rangers Program, identified approximately 100 North Korean IT workers who infiltrated 53 crypto projects during a six-month investigation that concluded April 16, 2026. The program recovered over $5.8 million in crypto and helped freeze hundreds of thousands of dollars received by bad actors, with blockchain investigator Nick Bax notifying more than 30 teams about DPRK workers on their payrolls. The investigation comes amid escalating North Korean crypto theft, with hackers stealing a record $2 billion in 2025 according to Chainalysis, including a $285 million hack of Solana-based Drift Protocol this month. U.S. authorities sentenced two American nationals to at least seven years in prison for helping DPRK workers pose as Americans to access 100 companies and funnel millions overseas, though eight defendants remain at large.

Ethereum Foundation's ETH Rangers Program Detection Results

• ▪The Ethereum Foundation's ETH Rangers Program reported more than 785 vulnerabilities.
• ▪The Ethereum Foundation's ETH Rangers Program has wrapped up as of April 16, 2026.
• ▪The Ethereum Foundation's ETH Rangers Program recovered more than $5.8 million in crypto.
• ▪The Ethereum Foundation's ETH Rangers Program detected around 100 DPRK IT workers across 53 crypto projects over a six-month period.
• ▪The Ketman Project co-authored a framework for identifying DPRK workers with the Security Alliance (SEAL).
• ▪Blockchain sleuth Nick Bax identified and notified more than 30 teams that DPRK workers were on their payroll through the ETH Rangers Program.
• ▪The Ethereum Foundation's ETH Rangers Program prompted dozens of incident responses.

North Korean IT Worker Infiltration of Crypto Projects

• ▪A 2023 United Nations report found that the DPRK has dispatched between 3,000 and 10,000 IT workers overseas.
• ▪As many as 1,500 DPRK IT workers were located in China according to numbers published in conjunction with the U.S. State Department.
• ▪Blockchain security firm Chainalysis found that North Korean hackers stole $2 billion in crypto in 2025, representing a 51% jump from the previous year.
• ▪North Korean hackers stole around $2 billion worth of crypto in 2025, a record-breaking amount.
• ▪Drift Protocol lost $285 million in crypto this month to a months-long social engineering hack masterminded by North Korean hackers.

U.S. Legal Action Against DPRK Facilitators

• ▪Two U.S. nationals who helped DPRK workers pose as Americans to gain access to 100 companies were sentenced to at least seven years in prison.
• ▪Two U.S. nationals received $700,000 for their roles in helping funnel millions of dollars from victimized U.S. companies overseas to DPRK workers.

Perspective of Ethereum Foundation

• ▪The Ethereum Foundation's ETH Rangers Program concluded operations on April 16, 2026 after completing its mission.
• ▪The Ethereum Foundation funded the Ketman Project through a stipend to investigate North Korean IT worker infiltration.

Perspective of Crypto projects targeted by DPRK workers

• ▪More than 30 crypto teams were notified by Nick Bax that they had DPRK workers on their payroll.

Perspective of North Korea

• ▪North Korean hackers achieved a record-breaking $2 billion in crypto theft during 2025, representing a 51% increase from the previous year.
• ▪North Korea dispatched between 3,000 and 10,000 IT workers overseas according to a 2023 United Nations report.

2 sources