You Won’t Believe Who Secretly Built Your Favorite Crypto Protocols!

by

Hold onto your toffee wrappers! A crypto detective claims North Korean IT whizz-kids have been sneaking into DeFi projects since DeFi Summer, naming over 40 cheeky creations in a viral thread.

Imagine a world where the goblins under the blockchain bridge aren’t stealing your gold-they’re building it! Yes, dear reader, North Korean techy elves apparently didn’t just swipe crypto, they were quietly typing it into existence.

Tay, a well-followed digital sleuth on X, announced that DPRK-linked developers had been lurking inside major crypto protocols ever since the sun shone on DeFi Summer. The revelation popped up after someone shared a hair-raising encounter with a suspected Lazarus agent during a job interview.

Tim, the brave soul posting on X, described how a potential hire-who later appeared in a Lazarus info dump-navigated technical interviews and video calls, only fleeing when asked to show up in person. Years later, it seems Lazarus prefers using non-North Korean minions for face-to-face shenanigans, making their sneaky ways even harder to detect.

Do read about the antics at Drift Protocol, where these state-linked tricksters embedded themselves for six months before a cheeky April 1st attack.

The Protocol List That Made Everyone Gasp

Tay’s revelation stopped the X-thread like a cat on a hot stove. When pressed for examples, the analyst rattled off a list of over 40 names: Sushi, Thorchain, Yam, Pickle, Harvest, Reclaim, Swing, Paid, Naos, Shezmu, Qrolli, Saffron, Sifu, Napier, Harmony, Blueberry, Stabble, Onering, Elemental, Divvy, La Token, Impermax, Kira, Cook, Fantom, Ankr, Gamerse, Metaplay, Spice, Beanstalk, DeltaPrime, Magiccraft, Hector, DeSpace, Depo, CreamFi, Shib, Kumainu, Starlink, Yearn, Floki. Tay admitted it was all just off the top of their pointy head.

Fantom and Yearn caused gasps among the seasoned cryptonauts. A bewildered user confessed they had no clue these projects had been secretly tickled by DPRK fingers.

Beanstalk sprouted its own tangled thread. Tay confirmed DPRK workers were involved, though the actual hack was another sneaky cell’s handiwork. Sifu tiptoed into the story through Vision and perhaps some Wonderland mischief.

Seven Years of Blockchain Wizardry. Absolutely True!

Here’s the kicker: these weren’t shambling, fake-resume robots. Tay noted plainly-the “7 years blockchain dev experience” on those resumes was real. Skilled, clever, embedded, and quietly influential.

Curious users asked how much DPRK had drained via this sneaky strategy. Tay estimated at least a jaw-dropping $6.7 billion.

Harmony came up with its own twist: a DPRK-linked worker there helped patch wallets after a hack, though the main heist was pulled off by a different DPRK gang. Sushi? Tay traced the link back to November 2025 research on Eratos (aka Anthony Keller and Daiki Saito) sneaking around SushiSwap, documented at chollima-group.io.

The Sneaky Shift Nobody Noticed

The thread unveils a structural calamity. OFAC’s recent strike against North Korean tech networks nabbed six individuals and two entities, with nearly $800 million funneled in 2024 alone. But Tay’s revelations show the problem stretches back much farther, running deep like chocolate syrup in a cake.

These DPRK developers weren’t just pocketing salaries-they were stitching the very architecture of your favorite crypto playgrounds.

The thread remains live, and Tay, the indefatigable sleuth, has been unraveling this mess for far too long-but with great panache.

Read More

2026-04-06 13:02