How a fake crypto startup lured North Korean IT workers into a trap

How a fake crypto startup lured North Korean IT workers into a trap

The sting revealed fake identities, remote-access tools and AI use, along with surprisingly shaky technical skills

Shreyas Reddy August 11, 2026

For North Korean information technology (IT) workers looking to generate funds for Pyongyang, a new startup promising to help wealthy cryptocurrency holders appeared to be a dream target. 

However, none of it was real.

In a report published Monday, Mauro Eldritch of cybersecurity firm Birmingham Cyber Arms, and Heiner Garcia of the threat intelligence company NorthScan drew the curtain back on how they spent weeks running an elaborate charade to expose DPRK IT workers.

The researchers previously posed as engineers supporting North Korean IT workers in a similar operation last year; this time

© Korea Risk Group. All rights reserved.
No part of this content may be reproduced, distributed, or used for commercial purposes without prior written permission from Korea Risk Group.