North Korea Spies Used Fake US Firms to Hack Crypto Developers: Report

Crypto Reporter

Shalini Nagarajan

Crypto Reporter

Shalini Nagarajan

About Author

Shalini is a crypto reporter who provides in-depth reports on daily developments and regulatory shifts in the cryptocurrency sector.

Author Profile

Share

Copied

Last updated: 

April 24, 2025

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Cyber operatives from North Korea infiltrated the US corporate system to launch a malware campaign aimed at crypto developers, Reuters reported Friday.

According to US cybersecurity firm Silent Push, North Korean hackers set up two companies, Blocknovas LLC and Softglide LLC, using fake names and addresses in New Mexico and New York.

Meanwhile, a third firm, Angeloper Agency, was also linked to the operation. However, it has not been officially registered in the country.

This campaign is tied to a subgroup within the Lazarus Group, a North Korean hacking unit under the Reconnaissance General Bureau, Pyongyang’s foreign intelligence agency.

FBI Cracks Down on North Korea-Backed Crypto Scam Targeting Developers

Further, the FBI reportedly seized Blocknovas’ domain on Thursday, stating the action was part of a broader law enforcement effort against North Korean actors using fake job offers to distribute malware.

In its report, Reuters said the hackers use fake job interviews to trick developers into downloading malware designed to access crypto wallets and developer credentials.

Further, Reuters reviewed public records showing Blocknovas was registered to a vacant lot in South Carolina. Meanwhile, Softglide’s paperwork traced back to a small tax office in Buffalo. Silent Push said Blocknovas was the most active of the three front companies. It had already compromised multiple victims.

Collectively, these activities violate sanctions imposed by the US Treasury’s Office of Foreign Assets Control. They also breach UN measures designed to stop North Korea from funding its weapons programs through overseas businesses.

Crypto Theft and Covert IT Ops Fuel North Korea’s Military Expansion

The incident adds to a growing list of sophisticated operations by Pyongyang targeting the crypto industry. These include sending thousands of IT workers abroad and carrying out high-profile cyber heists. The goal is to generate funds for North Korea’s nuclear ambitions.

Over the past few years, North Korea has increasingly turned to crypto-related crimes to raise funds. Notably, it has been linked to a string of high-profile thefts, including the 2022 Axie Infinity hack.

Parallely, the regime has also sent thousands of IT workers overseas. These workers are said to secretly send their earnings back to the state. Moreover, these activities are believed to support North Korea’s weapons program. Reports say stolen crypto assets have helped fund its ballistic missile development.