Ethereum Foundation IDs 100 North Korean IT Workers in Web3

The Ethereum Foundation announced findings from its six-month ETH Rangers security program, launched in late 2024, which identified approximately 100 information technology workers linked to North Korea operating within Web3 organizations under false identities. The initiative, conducted in partnership with groups including Secureum, The Red Guild, and the Security Alliance, focused on bolstering blockchain security across the Ethereum ecosystem and alerted about 53 projects to potential infiltrations.

The program funded independent researchers to conduct audits, vulnerability testing, and threat monitoring. One key effort, the Ketman Project, investigated fake developers and impersonators, particularly those tied to the Democratic People's Republic of Korea, known as DPRK. Researchers pinpointed the 100 individuals through patterns such as reused profile avatars and metadata across GitHub accounts, inadvertent exposure of unlinked email addresses during screen sharing, and default language settings, like Russian, that mismatched claimed nationalities. The Ethereum Foundation described the work as addressing a critical operational security threat in the sector.