North Korea Uses Foreign IT Workers to Infiltrate US Companies, Targeting Cryptocurrency Theft and Other Areas

BlockBeats news, September 13, according to NBC, North Korea is using IT workers from third countries such as Iran and Lebanon to help infiltrate US companies and obtain funds to support its weapons programs.

The United States and multiple countries issued alerts in July stating that North Korean IT personnel obtain contracts through remote work, remit income back to North Korean-related organizations, and may also pose insider security threats, involving data theft, cryptocurrency theft, and leakage of sensitive information.

As the United States and other countries strengthen crackdowns, North Korea has begun using third-country personnel to pass recruitment interviews at US companies. NBC said these foreign IT workers are recruited on platforms such as LinkedIn, and some can receive about $500 in cryptocurrency per month as "interview assistants." Once a job is successfully obtained, the relevant position is usually taken over by North Korean personnel.

According to previous statistics from CrowdStrike, cryptocurrency losses caused by North Korean government-linked hackers and threat actors in 2025 exceeded $2 billion, a year-on-year increase of 51%.