Ethereum Foundation Backs Major DPRK Infiltration Expose: 100 North Korean Operatives Unmasked in Web3

The Ethereum Foundation just backed a project that exposed what the crypto industry has quietly feared—over 100 North Korean IT workers operating undercover inside Web3 companies. This isn't theoretical security theater; it's actionable crypto intelligence that's already reshaping how projects vet their teams.

The ETH Rangers Program Delivers Real Security

The Ethereum Foundation launched its ETH Rangers program in late 2024 with a straightforward mission: fund individuals doing "public goods security work" within the ecosystem. One recipient took that mission seriously and built the Ketman Project, a six-month deep-dive investigation into what the foundation calls "one of the most pressing operational security threats facing the Ethereum ecosystem today."

The numbers tell the story. During their stipend period, the Ketman Project identified 100 different DPRK IT workers embedded across Web3 organizations. They then contacted approximately 53 projects to alert them about potentially active North Korean operatives on their payroll. That's not theoretical research—that's direct, measurable impact on portfolio security and operational integrity.

How They Caught DPRK Workers

While the Ethereum Foundation kept specifics close to the vest on identification methods, the Ketman Project's public-facing research reveals the operational patterns these operatives rely on. Their website catalogs the behavioral tells: reused avatars and profile metadata across multiple GitHub accounts, accidental screen shares exposing unlinked email addresses, default language settings (like Russian) contradicting claimed identities, and other technical red flags that separate real developers from imposters.

This matters for anyone managing crypto portfolios or evaluating blockchain projects. North Korean hacking operations—particularly the notorious Lazarus Group—have siphoned billions from the sector over the years. Knowing how to spot them moves the needle on due diligence.

Open-Source Tools and Industry Standards

Beyond exposure work, the Ketman Project built something the ecosystem can actually use: an open-source detection tool designed to flag suspicious GitHub activity. They also co-authored an industry-standard framework for identifying DPRK IT workers with the Security Alliance, a blockchain-focused nonprofit. Translation: other security teams don't have to reinvent the wheel. They can adopt proven detection methods immediately.

This represents crypto intelligence in its most practical form. Rather than abstract threat assessments, we're talking about shareable frameworks and detection tools that concrete improvement for market participants.