Researchers Set Up a Fake Crypto Company and Hired Three Suspected North Korean IT Workers

Key points

• Security researchers built a fake cryptocurrency startup, posted developer jobs, and hired three applicants they assess with medium confidence were North Korean operatives.
• Every virtual machine issued to the new hires was quietly recording, capturing the onboarding paperwork, identity documents and payment details the workers submitted.
• One hire claimed to live in Pasadena, Texas but produced a California driver's license and a New York bank account, a mismatch consistent with prior DPRK IT worker cases.
• US Treasury and FBI advisories tie this activity cluster, tracked by some vendors as Wagemole and overlapping with Lazarus-adjacent tasking, to sanctions-evading revenue for the North Korean regime.
• The researchers say the goal was to collect defender-useful artefacts, not to prosecute, and they are sharing hiring red flags with other employers.

A group of security researchers ran a sting on people they believe are North Korean IT workers, and the trap was a company that never existed.

They invented a cryptocurrency startup. They posted developer jobs. They interviewed applicants, made offers, and shipped work laptops. Three people took the jobs.

Every laptop was a virtual machine, meaning a software-only computer running inside the researchers' own systems, and it was recording the whole time. The hires did not know.

The result, first reported by The Hacker News, is a rare inside look at how suspected DPRK (Democratic People's Republic of Korea, the formal name for North Korea) IT workers get through Western hiring pipelines.

Who are these workers, and why does anyone care?

They are people the US government says are placed abroad by North Korea to take remote tech jobs under fake identities, then send most of their pay back to the regime. The FBI and Treasury have warned employers about the scheme since 2022.

Security vendors track the activity under several names. CrowdStrike calls the cluster Famous Chollima. Others file it under Wagemole, with TTPs, meaning tools, techniques and procedures, that overlap with the wider Lazarus umbrella North Korea runs for cyber operations. Attribution here is medium confidence: the behaviours fit, but any single hire could be a copycat or a fraudster with different motives.

Capability is one thing. Intent is another. Most of these workers appear to be doing the coding job they were hired for. The concern is the money trail, and the access a malicious insider could later abuse.

What did the researchers actually catch?

The onboarding paperwork. That is the part hiring teams can use tomorrow morning.

The first hire said he lived in Pasadena, Texas. He then sent a California driver's license. His bank account was in New York. Three states, one person, no clean explanation.

The researchers logged similar patterns across the other two hires: reused stock photos on resumes, video calls with laggy or filtered backgrounds, and requests to ship the laptop to an address that did not match the ID on file. None of these are proof on their own. Stacked together, they are a pattern HR teams can be trained to spot.

Should ordinary job seekers or customers worry?

Not directly. This is a hiring-fraud and sanctions story, not a data breach. No customer data was taken because no real customers existed.

The practical takeaway sits with employers. If you hire remote engineers, the cheapest control is a careful look at whether the address, the ID, and the bank account tell the same story. When they do not, ask why before you ship the laptop.