Is Your North Korean IT Worker Quiet Quitting?

Is Your North Korean IT Worker Quiet Quitting?

Speakers: Kaitlin Martin, Senior Intelligence Analyst, Chainalysis

Conference: CYBERWARCON

YouTube: https://www.youtube.com/watch?v=6ADu-KhznqE

Overview

In an insightful talk at CYBERWARCON, Kaitlin Martin, a Senior Intelligence Analyst at Chainalysis, unveiled the sophisticated on-chain money laundering techniques employed by North Korean (DPRK) IT workers. This presentation delves into the intricate web of cryptocurrency transactions that funnel illicit earnings from remote IT jobs directly into the DPRK regime's coffers, ultimately funding its weapons of mass destruction (WMD) and ballistic missile programs. Martin's research highlights how these workers, often operating under false identities in countries like China and Russia, exploit the global demand for IT talent and the innovative, yet sometimes less regulated, Web3 and cryptocurrency sectors.

The talk is crucial for understanding a significant revenue stream for the DPRK, which continually seeks novel ways to circumvent international sanctions. By focusing on the on-chain analysis of stablecoin payments, Martin demonstrates how investigators can track, link, and potentially disrupt these financial flows. The methodology presented leverages verified government data to validate open-source intelligence, offering a robust framework for attributing cryptocurrency activity to specific DPRK illicit operations and revealing the interconnectedness of their cyber ecosystem.

This deep dive into DPRK IT worker activities is particularly pertinent for companies operating in the digital economy, especially those utilizing remote workers or engaging with cryptocurrency payments. The findings provide actionable intelligence for identifying red flags, understanding the adversary's financial infrastructure, and bolstering defenses against a persistent and resourceful state-sponsored threat actor.

Background

▶ Watch: Introduction: Who are North Korean IT workers? (0:00)

The Democratic People's Republic of Korea (DPRK) faces severe international sanctions, compelling the regime to seek alternative, often illicit, revenue streams to fund its military and strategic programs. One primary method involves deploying thousands of highly skilled IT workers globally, predominantly in China and Russia, to secure remote IT jobs. These individuals, operating under fraudulent identities and often facilitated by entities like Chin Yong IT Corporation (sanctioned by the US and South Korea), infiltrate companies in the United States, Europe, and elsewhere. Their employers are typically unaware of their true affiliation with North Korean governmental agencies such as the General Reconnaissance Bureau or the Ministry of National Defense.

These IT workers often target innovative industries, including Web3 and cryptocurrency, where they can request their salaries be paid in digital assets. Stablecoins, cryptocurrencies pegged to real-world currencies (e.g., USD Coin, Tether), are particularly favored due to their stability in value, unlike volatile assets like Bitcoin or Ethereum. Once paid in stablecoins, these funds must be laundered and ultimately converted into fiat currency or other assets to be funneled back to the DPRK regime. This laundering process is the critical choke point that Chainalysis aims to expose and disrupt.

The data underpinning this analysis comes from two primary sources: highly reliable government agency reports and sanctions designations, which provide verified cryptocurrency addresses associated with DPRK IT workers or facilitators. Complementing this is open-source intelligence (OSINT), including community reporting of DPRK IT worker payment addresses and addresses linked to DPRK-attributed hacks. While OSINT offers a rich dataset, its lack of formal verification presents a challenge. The core problem this research addresses is how to leverage the confidence of government-verified data to validate and expand upon the unverified, yet extensive, OSINT reporting, thereby creating a more comprehensive and actionable intelligence picture of DPRK financial flows.

Key Findings

▶ Watch: Visualizing consolidation for long-term tracking (4:00)

The research presented by Kaitlin Martin uncovers several critical patterns and methodologies employed by DPRK IT workers for laundering their cryptocurrency earnings, significantly enhancing the ability to track and disrupt these operations:

1. Consolidation Points as Persistent Identifiers: DPRK IT workers systematically consolidate their individual cryptocurrency payments into shared addresses. These consolidation points serve as long-term financial hubs, collecting funds from multiple IT worker payment addresses, which themselves are often short-lived. This strategy allows investigators to track DPRK activity over extended periods, even as individual payment addresses change.
2. Verification of OSINT Data through On-Chain Connections: By identifying consolidation points linked to government-verified DPRK IT worker addresses, Chainalysis can confidently attribute other, previously unverified, payment addresses flowing into the same consolidation points as belonging to DPRK IT workers. This methodology effectively bridges the gap between high-confidence, limited government data and broader, but less certain, OSINT.
3. Commingling of Funds as an Attribution Tool: The research demonstrates that funds from DPRK IT worker operations frequently commingle with funds stolen in DPRK-attributed cyber hacks. Rather than complicating investigations, this commingling acts as a powerful on-chain investigation tool, allowing analysts to strengthen the attribution of specific hacks or intrusions to the DPRK by showing direct financial connections to known DPRK IT worker activities.
4. Ecosystem Analysis Reveals Deeper Cyber Operations: DPRK actors extensively use crypto bridges for chain hopping, moving funds across different blockchains to obscure their origins. Tracking these funds, particularly when they are swapped to the Bitcoin blockchain, reveals connections to the purchasing of cyber infrastructure (e.g., domain registration, VPN services like Astral VPN) used in more advanced DPRK cyber operations, such as ransomware attacks and extortion campaigns. This illustrates a unified and interconnected DPRK threat actor ecosystem.
5. Actionable Disruption Opportunities: The identification of active consolidation points, the use of stablecoins, and the ability to freeze funds held in stablecoin addresses (as demonstrated by recent DOJ seizures) provide concrete opportunities for law enforcement and intelligence agencies to disrupt DPRK financial operations and seize illicit assets.

Technical Deep Dive

▶ Watch: Tactic 2: Commingling funds to verify DPRK hacks (6:00)

Chainalysis employs a multi-faceted approach to trace and attribute the cryptocurrency laundering activities of DPRK IT workers, leveraging advanced on-chain analysis techniques within their Chainalysis Reactor tool.

Identifying Consolidation Points

A cornerstone of the methodology is the identification of consolidation points. DPRK IT workers, often operating under the same facilitator (like Chin Yong IT Corporation), sharing physical job sites in countries like Russia and China, or managing multiple fraudulent aliases, funnel their individual cryptocurrency payments into a single, shared address. This behavior is driven by the need to aggregate funds before further laundering or exfiltration to the regime.

• Mechanism: Multiple distinct IT worker payment addresses (represented as brown circles in Chainalysis Reactor visualizations) send funds to a single, common cryptocurrency address.
• Significance: While individual payment addresses might be active for only short periods (e.g., a few weeks or months), these consolidation points often remain active for years, receiving continuous inflows. This longevity makes them invaluable for tracking DPRK financial activity over time, providing a more stable target for monitoring than ephemeral individual payment addresses.
• Verification Expansion: Once a consolidation point is identified through a few government-verified IT worker addresses, any other address feeding into that same consolidation point can be confidently labeled as a DPRK IT worker payment address, even if previously unverified. This expands the known universe of DPRK IT worker activity significantly.

Leveraging Stablecoins for Disruption

DPRK IT workers predominantly request payment in stablecoins due to their pegged value, which mitigates the volatility inherent in other cryptocurrencies. This preference presents a unique advantage for investigators.

• Freezing Capability: Unlike decentralized cryptocurrencies, stablecoins are often issued by centralized entities. This centralization means that stablecoin issuers, upon receiving a valid law enforcement request (e.g., a subpoena or court order), can freeze funds held in specific addresses.
• Real-World Impact: This capability has led to tangible successes, such as the recent Department of Justice (DOJ) announcement of seizing $15 million in DPRK IT worker funds by freezing stablecoin balances. This demonstrates a direct and effective means of disruption.

Commingling as an Investigation Tool

In many illicit finance investigations, the commingling of funds from different crime types can complicate attribution. However, in the context of DPRK operations, Chainalysis argues that this commingling serves as a powerful investigative tool.

• Cross-Attribution: When funds from known DPRK IT worker addresses are tracked downstream and found to merge with funds stolen in a hack that is suspected, but not definitively proven, to be carried out by DPRK actors, it significantly strengthens the attribution of that hack to North Korea.
• On-Chain Evidence: Chainalysis Reactor visualizations clearly show these connections, providing visual evidence of funds from verified IT worker operations ending up in wallets that also received stolen funds from suspected DPRK hacks. This pattern reinforces hypotheses and moves uncertain attributions towards definitive conclusions.

Ecosystem Analysis and Chain Hopping

DPRK actors exhibit a highly interconnected and sophisticated cyber ecosystem. Understanding this requires analyzing how funds flow between different DPRK threat actor groups and the services they rely upon.

• Crypto Bridges: A key laundering technique is chain hopping using crypto bridges. Bridges are protocols that allow users to transfer tokens from one blockchain to another (e.g., Ethereum to Binance Smart Chain or Polygon).
• Bridge Explorers: Just like blockchain explorers, many crypto bridges offer explorers that allow real-time tracking of token movements across chains. Investigators can use these tools to follow the laundering trail even after funds leave their initial blockchain.
• Bitcoin Blockchain Connection: Martin highlighted a particularly interesting pattern: when IT worker funds are bridged and eventually swapped to the Bitcoin blockchain. This is significant because the Bitcoin blockchain is where Chainalysis observes DPRK's "deeper cyber operations," including ransomware, extortion campaigns, and crucially, the purchasing of cyber infrastructure.
• Infrastructure Procurement: DPRK actors utilize Bitcoin to acquire essential infrastructure services like domain registration and VPN services. A specific example cited is Astral VPN, which Chainalysis's Cyber Threat Intelligence (CTI) team has identified as being "prolifically used by DPRK in their cyber operations."
• Holistic View: By connecting IT worker funds to infrastructure used in more advanced cyber operations, Chainalysis draws a holistic picture of the DPRK threat actor ecosystem. This integrated view, spanning IT workers, crypto hackers, ransomware operators, and infrastructure procurers, reveals a highly organized and financially interdependent network, opening up more strategic opportunities for disruption.

Demo / Proof of Concept

▶ Watch: Tactic 3: Using crypto bridges for chain hopping (8:00)

While the talk did not feature a live, interactive demonstration, Kaitlin Martin effectively leveraged screenshots from Chainalysis Reactor, their proprietary crypto tracing tool, to visually illustrate the complex on-chain analysis techniques. These graphical representations served as compelling proof-of-concept for the methodologies discussed.

The initial Reactor screenshots demonstrated the core concept of consolidation points, showing multiple brown circles (representing individual IT worker payment addresses) funneling funds into a single, larger node (the consolidation point). These visuals highlighted how some payment addresses might be inactive for years, while the consolidation point continues to receive funds from recently active addresses, underscoring its value for long-term tracking.

Further Reactor graphs visually depicted the verification process, where government-confirmed DPRK IT worker addresses were linked to a consolidation point, subsequently validating other unverified addresses feeding into it. The most impactful visualizations showcased the commingling of funds, illustrating how verified IT worker funds flowed downstream into wallets that also received stolen funds from suspected DPRK hacks. These visual connections provided strong, empirical evidence for attributing broader illicit activity to the DPRK.

Finally, the presentation used Reactor graphs to trace IT worker funds that had undergone chain hopping via crypto bridges, ultimately leading to services like Astral VPN on the Bitcoin blockchain. This demonstrated the ability to connect seemingly disparate DPRK activities—remote IT work and advanced cyber operations—through their shared financial infrastructure. The success of the DOJ in seizing $15 million in DPRK IT worker funds from stablecoin addresses, mentioned in the talk, further validates the practical effectiveness and real-world applicability of these on-chain analysis techniques.

Defensive Implications

▶ Watch: Connecting IT workers to deeper cyber operations (10:00)

The detailed insights into DPRK IT worker operations and their laundering techniques offer several critical implications for defenders across various sectors:

1. Enhanced Due Diligence for Remote Workers: Companies, especially those in innovative tech sectors like Web3 and cryptocurrency, must implement rigorous background checks and continuous monitoring for all remote IT hires. Focus on verifying identities, scrutinizing discrepancies in resumes or personal details, and being wary of individuals who insist on specific payment methods, particularly stablecoins to non-institutional wallets.
2. Scrutiny of Cryptocurrency Payment Addresses: Organizations paying contractors or remote workers in cryptocurrency should monitor the destination addresses. Look for patterns of funds being immediately consolidated into shared addresses or rapidly transferred across multiple blockchains (chain hopping). Any requests for payment in stablecoins should trigger heightened scrutiny.
3. Monitor for Commingling of Funds: Financial institutions and cryptocurrency exchanges should enhance their transaction monitoring systems to identify instances where funds originating from known or suspected DPRK IT worker addresses commingle with funds from other illicit activities, particularly those linked to cyber hacks. This commingling can be a strong indicator of DPRK involvement.
4. Awareness of DPRK's Laundering Infrastructure: Defenders should be aware of DPRK's propensity to use crypto bridges for chain hopping and their strategic use of the Bitcoin blockchain for purchasing cyber infrastructure. Monitoring for these patterns can help identify potential DPRK financial activity.
5. Identify and Block Known DPRK Infrastructure: Specific services like Astral VPN have been identified as prolifically used by DPRK actors. Organizations should incorporate intelligence on such services into their threat intelligence platforms and consider blocking or monitoring network traffic associated with them.
6. Collaboration with Law Enforcement and Analytics Firms: Companies that suspect they may have employed DPRK IT workers or been impacted by their financial schemes should collaborate with law enforcement agencies and blockchain analytics firms like Chainalysis. These entities possess the tools and expertise to trace funds and aid in potential asset seizure.
7. Stablecoin Freezing Potential: For companies or exchanges dealing with stablecoins, understanding the potential for freezing illicit funds is crucial. While this is primarily a law enforcement tool, it highlights the importance of working with stablecoin issuers and adhering to regulatory requirements to prevent abuse.

Key Takeaways

• DPRK IT workers are a significant funding source for the regime's WMD programs, leveraging remote IT jobs and cryptocurrency payments.
• Consolidation points are critical on-chain indicators, allowing for long-term tracking of DPRK IT worker funds and verification of unverified OSINT data.
• Commingling of IT worker funds with stolen funds from cyber hacks acts as a powerful investigative tool for attributing illicit activity to the DPRK.
• DPRK extensively uses crypto bridges for "chain hopping" to obscure financial trails, ultimately moving funds to the Bitcoin blockchain for purchasing cyber infrastructure like VPN services (e.g., Astral VPN).
• The preference for stablecoins by DPRK IT workers offers a unique opportunity for disruption, as stablecoin issuers can freeze illicit funds upon law enforcement request, leading to successful seizures.
• A holistic ecosystem analysis, connecting IT worker activities with broader cyber operations, is essential for a comprehensive understanding and effective disruption of the DPRK threat actor network.

About the Speaker(s)

Kaitlin Martin is a Senior Intelligence Analyst at Chainalysis, a blockchain analysis company that provides data and software to government agencies, exchanges, and financial institutions. Her work focuses on tracking complex and broad topics within the cryptocurrency space, with a particular expertise in understanding the on-chain laundering techniques employed by state-sponsored actors like North Korean IT workers. Her role involves leveraging Chainalysis's tools and data to provide actionable intelligence for disrupting illicit financial flows.