North Korean IT experts have been working in DeFi projects for seven years
North Korean IT specialists have been involved in developing DeFi projects for at least seven years, according to MetaMask developer Taylor Monahan. She noted that many protocols were created by them during the so-called "DeFi summer," and their experience on resumes is genuine.
Monahan identified several projects associated with North Korean developers, including SushiSwap, Thorchain, Fantom, Shib, Yearn, Floki, and others. This came in response to comments by Tim Ahl, founder of the Solana aggregator Titan, who shared his experience interviewing a member of the Lazarus Group.
Ahl stated the candidate was qualified but declined an in-person meeting, leading to rejection. Later, the candidate’s name appeared in a Lazarus data leak. Ahl also noted that the group now has agents outside North Korea, who gain trust to infiltrate networks.
The discussion intensified after the Drift Protocol hack, where $280 million was stolen. The project’s developers linked the incident to hackers from North Korea.
The Lazarus Group is known as one of the most active North Korean hacking organizations, specializing in cybercrimes and financial attacks. Its operations include cyber espionage, crypto asset hacks, and attacks on governmental institutions.
This situation shows the long-term integration of North Korean cybercriminals into the global DeFi ecosystem, using their expertise to carry out large-scale cybercrimes. This poses significant security challenges for the protection of digital assets worldwide.
Going forward, strengthening cybersecurity and international cooperation will be crucial to counter highly organized cybercrime groups and safeguard global financial markets.
