DPRK Employment Fraud Targeting Crypto Companies
Contents
DPRK Employment Fraud Is Targeting Crypto Companies
In June 2025, a candidate named “Jo” applied to Nisos for a remote Lead AI Architect role. On paper, he looked strong: 15+ years of experience, a resume aligned tightly to the job description, a Florida address, a local phone number.
He was not who he said he was.
Over the course of a three-month investigation (later reported by NBC News) Nisos identified Jo as a suspected Democratic People’s Republic of Korea (DPRK) operative, traced him to an apparent network of at least 20 North Korean workers who had collectively applied to roughly 160,000 roles, and uncovered a U.S.-based laptop farm supporting the operation. You can read the full investigation here.
But Jo’s story is not the story.
The story is that Jo is likely one of thousands of DPRK operatives using employment fraud to target crypto companies.
The Scale of the Threat
The numbers are stark. The U.S. State …
In June 2025, a candidate named “Jo” applied to Nisos for a remote Lead AI Architect role. On paper, he looked strong: 15+ years of experience, a resume aligned tightly to the job description, a Florida address, a local phone number.
He was not who he said he was.
Over the course of a three-month investigation (later reported by NBC News) Nisos identified Jo as a suspected Democratic People’s Republic of Korea (DPRK) operative, traced him to an apparent network of at least 20 North Korean workers who had collectively applied to roughly 160,000 roles, and uncovered a U.S.-based laptop farm supporting the operation. You can read the full investigation here.
But Jo’s story is not the story.
The story is that Jo is likely one of thousands of DPRK operatives using employment fraud to target crypto companies.
The Scale of the Threat
The numbers are stark. The U.S. State …
IoC
https://nisos.com