Analysis: North Korean IT labor networks infiltrate overseas enterprises using fake identities, with related crypto funds flowing to platforms such as Bybit.

Security firm SlowMist has published an analysis of the U.S. Treasury Department’s latest sanctions targeting North Korean IT labor networks, noting these networks do not merely secure remote work opportunities via fake identities, but instead rely on overseas facilitators, device collection points, and multi-layered financial intermediaries to form a complete operational ecosystem. The associated risks may also extend to corporate internal data and system security. In on-chain fund tracking, SlowMist’s subsidiary MistTrack identified multiple financial links between 8 Ethereum and Tron addresses listed by OFAC. Some addresses directly transferred funds to one another, while several others sent funds to deposit addresses of exchanges including Bybit and HTX. Among these, an Ethereum address linked to Russian citizen Boykov received a total of approximately $470 million in USDC, $463 million in USDT, and $1.022 billion in DAI. SlowMist also noted that a Tron address linked to Boykov transferred 1.4 million USDT to Obertas’s Bybit deposit address; another address sent 1.4 million USDT across 7 transactions, accounting for 86.2% of that address’s total outgoing funds. These on-chain records further reveal financial ties between individuals on the sanctions list. SlowMist warned that North Korean IT laborers typically conceal their true identities and locations through methods such as stolen or forged identities, VPNs, overseas device collection, and “laptop farms”. If companies fail to identify the individuals actually operating devices, they may expose code repositories, customer data, and internal system permissions. The firm advised enterprises to integrate identity verification, device delivery, outsourced personnel management, and system access control into a unified review process; exchanges and custodial institutions should include relevant sanctioned addresses in daily screening and on-chain transaction monitoring.