Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Core Points
- Recruitment Strategy: Pyongyang is recruiting IT professionals in Nigeria, South Africa, Iran and India to assist their personnel in placing fake employees among U.S. companies.
- Operating model: These international "interview agents" receive compensation of approximately US$500 per month, usually paid in cryptocurrency. After receiving an employment contract, North Korean agents took over the position and remitted their salaries to Pyongyang.
- Scale and impact: Intelligence estimates that the operation generates US$600 million to US$800 million in revenue to North Korea every year. In 2025, total losses from North Korea's cyber operations, including cryptocurrency theft, exceeded US$2 billion.
Recruitment tactics against agents
Pyongyang has significantly expanded its ongoing campaign to embed fraudulent IT professionals in U.S. and multinational technology companies. The complex operation now relies on third-party associates from different countries who assist North Korean agents in clearing job interviews and circumventing the verification process.
According to an investigative report released by NBC News on September 11, 2026, which cited information from U.S. government sources and cybersecurity experts, the network has been expanded to include participants from Nigeria, South Africa, Iran, India and multiple Latin American countries.
Breaking News: North Korea is reportedly using foreign workers to help its agents infiltrate U.S. companies through fake remote work applications.
- EyeWhales (@EyeWhales) September 12, 2026
Research by cybersecurity organization Flare shows that North Korean managers actively use professional social networking sites such as LinkedIn to find software developers. Those selected receive quotes of about $500 a month to serve as "interview stand-ins" and appear via video conferencing during the recruitment process to pose as real candidates.
Researchers reviewed a communication record in which a North Korean manager explained to potential associates: "You come from a sanctioned country. If you are still interested in the role, I need to confirm if you are willing to work under someone else."
Countries like Iran are the main targets because developers there face limited opportunities for legitimate international employment due to existing sanctions regimes, which increases their vulnerability to these proposals.
Security research organizations Kudelski Security and DTEX have independently confirmed that software professionals from South Africa, Syria, Iran, Nigeria, Pakistan and Latin America have been contacted through this recruitment network.
Scale of the operation
United Nations analysts calculate that North Korea's remote technician operations generate approximately US$600 million in annual revenue. A sanctions monitoring report coordinated by U.S. authorities estimates that the total in 2024 will reach $800 million.
A comprehensive U.S. intelligence assessment believes that North Korea earns no less than $1 billion in total annual revenue through cyber activities, including IT worker programs and digital currency theft. In May 2026, well-known cybersecurity company CrowdStrike recorded that a state-backed North Korean hacker group stole more than $2 billion in cryptocurrency in 2025, a 51% increase from the previous year.
The Bank of Korea estimates that North Korea's economy will grow by about 3.5% in 2025 despite facing comprehensive international sanctions.
In July 2026, the U.S. State Department and Justice Department and international partners issued a joint advisory notice stating that North Korea is using "increasingly sophisticated" methods to recruit its foreign personnel to conceal their identities as agents.
Blockchain technology company Consisys has publicly admitted that it inadvertently and unwittingly outsourced development work to North Korean agents.
