North Korean Workers Infiltrate 40+ DeFi Protocols

Cybersecurity researcher Taylor Monahan disclosed on social media platform X that North Korean-linked IT workers have contributed to more than 40 major decentralized finance protocols over the past seven years, including during the rapid growth period known as DeFi summer in 2020. The revelation, shared on April 5, 2026, highlights how these operatives, often using stolen or synthetic identities, integrated into open-source blockchain development teams through standard hiring channels like LinkedIn and job boards.

Monahan, a developer at MetaMask, analyzed contributor patterns, code repositories, and professional profiles to identify the involvement. She noted that the blockchain development experience claimed on these workers' resumes, typically seven years, appears legitimate based on the quality and volume of their contributions. Prominent projects affected include SushiSwap, a decentralized exchange; THORChain, a cross-chain liquidity protocol; Yearn Finance, a yield optimizer; Harmony, a scalability-focused blockchain; Ankr, an infrastructure provider; and Shiba Inu, a token ecosystem. Other protocols mentioned span a wide range, from Yam Finance to Beanstalk,...