The defendants include Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il. According to the US Department of Justice, from 2020 to 2022, they worked as remote developers under false names at two cryptocurrency companies — one in Atlanta, USA, and the other in Serbia. To hide their citizenship, the defendants provided their employers with fake documents, including those stolen from other people.
Having gained access to the companies' internal systems, Kim Kwang-jin and Jeong Bong-ju used their official positions to steal cryptocurrency. Specifically, in February 2022, Jeong Bong-ju stole $175,000, and in March of the same year, Kim Kwang-jin changed the program code of two smart contracts, which allowed him to appropriate crypto assets worth about $740,000.
To hide traces of illegal transactions, the attackers used crypto mixers - services that make it difficult to track transactions. The funds were then transferred to exchange accounts controlled by Kang Tae-bok and Jang Nam-il. The Justice Department reports that these accounts were registered using forged documents allegedly belonging to Malaysian residents.
US Assistant Attorney General John A. Eisenberg noted that such actions are aimed at circumventing sanctions and financing prohibited programs of the North Korean regime, including those related to weapons development.
Cybersecurity experts from SlowMist warn that North Korean hackers are not limited to attacks on employers. They are also targeting potential employees of crypto companies by distributing malware called OtterCookie, which steals users’ personal data.
The criminal scheme thus involves creating fake identities to work for companies, stealing digital assets through manipulation of software code, and complex money laundering operations using crypto mixers and fake accounts. US authorities are continuing their investigation, emphasizing the danger such cybercrimes pose to the financial system and national security.