North Korea-Associated Scammers Aim at UK Cryptocurrency Companies, Google Alerts

Tech operatives associated with North Korea are expanding their infiltration into global blockchain enterprises, with a significant pivot towards targeting companies in the United Kingdom and Europe, as reported by Google’s Threat Intelligence Group (GTIG).

This shift is a response to increased scrutiny from U.S. officials, compelling many involved to look for opportunities outside American boundaries.

DISCOVER: Top Meme Crypto token ICOs to Invest in March 2025

North Korea-Connected Cyber Con Artists Establish Global Protocol of Fake Identities, Claims Google

In a report published on April 2, GTIG advisor Jamie Collier revealed that fraudulent IT personnel linked to North Korea are evolving in response to rising awareness in the U.S. by constructing a global web of fake identities.

“In reaction to the increased recognition of the threat in the United States, they’ve developed a global network of deceitful personas to improve operational flexibility,” Collier remarked.

Collier pointed out that the existence of collaborators in the UK indicates the creation of a wider support platform, allowing these operatives to continue their illicit activities.

These individuals have successfully infiltrated various projects, from conventional web development to sophisticated blockchain applications, including contributions to Solana and Anchor smart contracts.

In one instance, North Korean developers were engaged in a blockchain-powered job marketplace and an AI-driven web app utilizing distributed ledger technologies.

Often, these workers pretend to be legitimate remote employees, granting them access to corporate systems and diverting revenue back to the North Korean government.

“This poses a risk of espionage, data theft, and disruption to organizations that employ DPRK IT workers,” Collier cautioned.

GTIG has observed a widening interest in Europe beyond the UK. Investigators found at least one North Korean individual employing 12 distinct identities across various European nations.

Experiencing audio issues on your Zoom call? That’s not a VC, it’s North Korean hackers.

Fortunately, this founder recognized what was happening.

The call begins with a few “VCs” present. They send messages in the chat indicating they can’t hear your audio or suggesting there’s an… pic.twitter.com/ZnW8Mtof4F

— Nick Bax.eth (@bax1337) March 11, 2025

Numerous others submitted applications mentioning diplomas from Belgrade University and living in Slovakia. Additional discoveries included efforts to seek employment in Germany and Portugal, pilfered credentials for job platforms, and a broker supplying counterfeit passports.

EXPLORE: 10 Top AI Crypto Coins to Invest in 2025

Report Indicates Rise in Extortion Threats by Laid-Off Workers Since October

The report also points out an increase in extortion efforts since October. In multiple instances, recently laid-off employees threatened to leak sensitive information or sell it to rivals. The targeted data included proprietary source code and internal project documents.

In the U.S., the crackdown on such activities has escalated. In January, the Justice Department charged two North Korean individuals for masterminding a fraudulent IT employment scheme involving more than 60 companies.

Concurrently, the U.S. Treasury imposed sanctions on entities alleged to function as front companies for North Korean IT operations.

Meanwhile, founders of crypto projects continue to sound the alarm. On March 13, at least three reported thwarting North Korean phishing attempts disguised as fake Zoom interviews.

In August, distributed record investigator ZachXBT disclosed that North Korean developers were generating up to $500,000 monthly while working within legitimate crypto firms.

EXPLORE: 10 Coins with High Returns: Crypto Forecast 2025

The post North Korea-Linked Fraudsters Target UK Crypto Firms, Google Warns appeared first on 99Bitcoins.