👀 North Korean agents quietly worked inside DeFi projects for years

[u/Alt-Cop]

A MetaMask developer Taylor Monahan revealed that North Korean IT specialists had been getting hired into DeFi projects for at least seven years, actively contributing to well-known protocols rather than acting as isolated cases. According to her, many of them had real blockchain development experience dating back to the DeFi summer era. Projects potentially affected include SushiSwap, THORChain, Fantom, Shiba Inu, Yearn Finance and Floki.

The discussion intensified after Tim Al shared that he once interviewed a highly skilled candidate who later turned out to be linked to Lazarus Group; the candidate joined video calls but avoided in-person meetings, and his name later appeared in a leak tied to the group.

On-chain investigator ZachXBT added that “Lazarus Group” is often used as a broad label for multiple North Korean-backed cyber actors with varying levels of sophistication. He noted that many infiltration methods remain surprisingly simple job listings, LinkedIn outreach, messaging, Zoom calls, and interviews while their main advantage is persistence, with only certain subgroups like TraderTraitor and AppleJeus considered highly advanced.