North Korea Enlists Foreign Proxies Paid in Cryptocurrency to Infiltrate US Tech Companies

A Coordinated Infiltration Campaign

North Korea is executing an increasingly sophisticated strategy to breach US companies and finance its weapons programs, according to NBC reporting released Friday. The DPRK has enlisted remote workers from third countries, notably Iran and Lebanon, to participate in a coordinated infiltration campaign. The scheme operates straightforwardly: third-country IT workers pose as job candidates during interviews for US-based technology positions. Once employment contracts are secured, operational control of those positions transfers to North Korean operatives, embedding insider threats within target organizations.

Cryptocurrency Payments Fuel the Proxy Network

North Korea’s reliance on cryptocurrency to fund this operation reveals the deep intersection between state-sponsored cyber warfare and digital assets. According to NBC’s investigation, foreign proxy workers were actively recruited through LinkedIn and offered approximately $500 monthly in cryptocurrency compensation to work part-time as “interview associates.” Upon deployment within US companies, these North Korean operatives pursue data exfiltration, cryptocurrency theft, and sensitive information theft while simultaneously remitting their official salaries to parent North Korean agencies. An alert issued in July by the US government and multiple foreign agencies warned that North Korean IT workers “seek out contracts with the intent of remitting their salaries to their parent North Korean agencies” and “pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.”

Quantifying the Threat to Crypto Markets

The effectiveness of these operations manifests starkly in cryptocurrency theft figures. Cointelegraph reported in May, citing cybersecurity firm CrowdStrike, that North Korean state-affiliated hackers were responsible for more than $2 billion in cryptocurrency losses in 2025 alone—a remarkable 51% year-on-year increase. This trajectory demonstrates both the sophistication of these attacks and their growing financial importance to the regime. The Bank of Korea’s assessment that North Korea’s GDP expanded 3.5% in 2025 despite comprehensive global sanctions suggests these cyber-theft and recruitment operations meaningfully support the regime’s economy. The dual role of cryptocurrency—serving simultaneously as both the payment method for proxy operatives and the primary theft target—underscores how digital assets have become central infrastructure for state-sponsored cyber operations and reveals a critical vulnerability requiring enhanced security protocols across crypto exchanges, custodians, and technology companies.

Source: NBC, via Cointelegraph. Not financial advice.