Investigation Reveals Alleged North Korean Crypto Worker Network Generating $1M Monthly

Blockchain investigator ZachXBT has uncovered details of a suspected North Korean IT worker network allegedly generating millions of dollars through remote work and cryptocurrency payments.

According to information shared on X, in a recent investigation, leaked data from an internal payment server exposed hundreds of accounts believed to be connected to workers operating under false identities. The data reportedly included login credentials, payment records, and internal communications used to coordinate activity.

The server contained information on roughly 390 accounts, many of which were tied to workers posing as freelance developers or IT professionals to secure remote jobs at international companies. Payments from these jobs were often made in cryptocurrency, which was then routed through multiple wallets before being converted into fiat currency.

Zach estimates the network may have been earning up to $1 million per month through these operations.

The exposed system also revealed surprisingly weak security practices. Several accounts were reportedly still using the default password 123456, making it easier for the data to be accessed after the system was compromised.

Blockchain tracking linked several wallets involved in the operation to more than $3.5 million in transactions since late 2025. In at least one case, a wallet on the Tron network was frozen after funds were traced to the suspected operation.

The findings highlight growing concerns about state-linked actors exploiting remote work opportunities and cryptocurrency payments to generate revenue.

Zach says the case underscores the need for stronger identity verification and security practices across the crypto and remote-work industries.