Counterhacker exposes DPRK unit that made $1M a month working IT jobs

The North Korean IT workers coordinated crypto payments through a server using a shared, easy-to-guess password “123456.”

A group of North Korean IT workers made more than $3.5 million in just a few months by faking their identities to work as developers while also attempting to hack crypto projects, according to documents obtained by a hacker who compromised one of their devices.

The leaked data obtained by the unnamed hacker was shared by blockchain sleuth ZachXBT in a post to X on Wednesday. It revealed that one of the IT workers, “Jerry,” and a team of 140 members were making roughly $1 million a month, amounting to $3.5 million worth of crypto since late November.

The North Korean IT workers coordinated payments on a website called “luckyguys.site” using a shared password, “123456,” ZachXBT said, adding that some of the users on that platform appeared to work for Sobaeksu, Saenal and Songkwang, which are sanctioned by the US Office of Foreign Assets Control.

Read more