The tweet was deleted by the author.
But we saved everything 🙂.
MetaMask says North Korean operatives embedded in crypto firms for years
North Korean IT workers have been operating inside crypto companies and DeFi projects for at least seven years, according to security researcher and MetaMask developer Taylor Monahan.
She says dozens of DeFi protocols — including well-known platforms — may have used code developed by these specialists. At the same time, the “seven years of blockchain development experience” listed on their resumes is often genuine.
Experts link this activity to the Lazarus Group — a North Korean-affiliated hacking collective. According to analysts at R3ACH, the group has stolen around $7 billion in crypto since 2017. Among the most high-profile attacks are the $625 million Ronin Bridge hack, the $235 million WazirX exploit, and the $1.4 billion Bybit heist.
New concerns intensified after the $280 million exploit of Drift Protocol. The project said there is a high probability that the attack was carried out by actors linked to North Korea.
A long-running scheme
Industry insiders confirm that such tactics have been used for years. Titan Exchange founder Tim Ahhl said his team once interviewed a candidate who later turned out to be linked to Lazarus. According to him, the candidate appeared highly professional and participated in video interviews but avoided meeting in person. His name was later found in a database associated with the hacking group.
In the case of Drift Protocol, the situation was even more complex. According to the investigation, the interaction did not involve North Korean nationals directly, but rather intermediaries with fully constructed identities — including work histories, public profiles, and professional networks.
The main threat to the crypto market
The scale of the problem is far greater than it may seem. According to Chainalysis, hackers stole more than $3.4 billion in crypto in 2025, with the majority of those attacks linked to North Korea. In just one year, DPRK-affiliated groups accounted for about $2.02 billion — roughly 60% of total industry losses.
In fact, this points to the dominance of a single actor. Reports show that North Korean groups, including Lazarus, are responsible for up to three-quarters of attacks on crypto platforms, and their operations tend to cause significantly greater damage than those of other hackers.
At the same time, the Lazarus Group is no longer targeting only companies and startups. Recently, it expanded its operations to individual investors, stealing $5.2 million from a trader.
This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.
Subscribe to TU news
Did you like the article?
Latest Crypto News
Weekly Top Bonuses
Top News
Top 5 companies for you
United States
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
Live News
