Ethereum Foundation Investigation Uncovers 100 North Korean Operatives in Blockchain Firms

An investigation funded by the Ethereum Foundation has revealed that approximately 100 individuals linked to North Korea have infiltrated blockchain companies using false identities, raising significant security concerns for the Web3 sector.

April 24, 2026
Ethereum Foundation Investigation Uncovers 100 North Korean Operatives in Blockchain Firms

The Ethereum Foundation's ETH Rangers initiative has uncovered a major security threat within the blockchain industry. According to a report from the Ketman Project, one of several efforts funded under the program, roughly 100 individuals linked to North Korea have secured roles inside blockchain companies by using false identities.

The discovery of these embedded operatives highlights the vulnerabilities in the hiring practices of many Web3 firms. The report suggests that companies like Canaan Inc. (NASDAQ: CAN) may need to implement thorough background checks to ensure all employees are legitimate. The implications of this infiltration are profound, as these operatives could potentially access sensitive information, manipulate systems, or engage in cyber espionage.

The Ketman Project's findings were shared via CryptoCurrencyWire, a specialized communications platform focused on blockchain and cryptocurrency. The investigation underscores the ongoing challenges the industry faces in combating state-sponsored threats, particularly from North Korea, which has been known to use cyber operations to generate revenue and bypass international sanctions.

The Ethereum Foundation's ETH Rangers initiative aims to identify and mitigate security risks within the Ethereum ecosystem. This latest revelation is a stark reminder that the decentralized nature of blockchain technology does not automatically protect against malicious actors. Companies operating in the Web3 space must prioritize security protocols, including rigorous identity verification and continuous monitoring of employees.

As the blockchain industry continues to grow, the need for robust security measures becomes increasingly critical. The infiltration of North Korean operatives could have far-reaching consequences, from financial theft to the disruption of decentralized applications. Industry leaders are now calling for enhanced collaboration between blockchain firms and cybersecurity experts to address these threats.

The full implications of this discovery are still unfolding, but it is clear that the Web3 sector must take proactive steps to protect its ecosystem. The Ethereum Foundation's investigation serves as a wake-up call for all companies involved in blockchain technology to reassess their security practices and remain vigilant against state-sponsored infiltration.