According to PANews, blockchain investigator ZachXBT has uncovered evidence of a complex network of North Korean developers who reportedly earn up to $500,000 monthly by working on established cryptocurrency projects. In an August 15 post, ZachXBT suggested that a single entity, likely operating outside North Korea, employs at least 21 developers involved in over 25 crypto projects, generating between $300,000 and $500,000 per month.

ZachXBT revealed that a team recently sought his assistance after malicious code led to the theft of $1.3 million from their treasury. He traced the stolen funds, which were laundered through a series of transactions, ending with 16.5 Ethereum. Further investigation indicated that these developers are part of a broader network. ZachXBT tracked multiple payment addresses and discovered that the group received $375,000 last month and a total of $5.5 million from July 2023 to an unspecified date in 2024. These funds were deposited into an exchange address and linked to North Korean IT workers and Sim Hyon Sop, who has been sanctioned by the U.S. Office of Foreign Assets Control (OFAC) for allegedly coordinating financial transfers supporting North Korea's weapons program.

ZachXBT's investigation also found other payment addresses closely associated with Sang Man Kim, another individual sanctioned by OFAC for past cybercrimes related to North Korea. Additionally, some developers claiming to work in the U.S. and Malaysia had overlapping Russian telecom IPs. At least one employee inadvertently revealed their other identities in a notepad. Some developers were even arranged by recruitment companies and, in certain cases, recommended each other for jobs.