The Ethereum Foundation revealed on Thursday that its six-month ETH Rangers program — run in collaboration with the Ketman Project and the Security Alliance (SEAL) — discovered nearly 100 IT workers linked to the Democratic People’s Republic of Korea embedded in 53 cryptocurrency projects, while simultaneously recovering $5.8 million in funds and exposing more than 785 vulnerabilities, with the findings published in the same week that the US Department of Justice announced that two citizens had been sentenced. Two Americans were jailed for at least seven years for helping Democratic People’s Republic of Korea operatives pose as US-based developers to hack nearly 100 local companies.
We believe this is less a story about an organization’s security program than a structural indication of how deeply state-sponsored labor has infiltrated the cryptocurrency recruitment pipeline — and how poorly equipped most projects are to detect it.
The ETH Rangers program is over and the results speak for themselves: over $5.8 million recovered, over 785 vulnerabilities reported, over 100 DPRK clients identified, and much more.
Decentralized defense for a decentralized network.
Read the full summary 👇
— EF Ecosystem Support Program (@EF_ESP) April 16, 2026
The industry exposure here is not primarily technical. It is procedural: verification loopholes in remote hiring, inadequate background screening, and the absence of infrastructure for project-level sanctions compliance have combined to create conditions under which DPRK workers can work for months—or years—before being discovered.
discovers: The Best Cryptocurrencies You Can Buy Right Now – Updated CoinSpeaker Guide
ETH Rangers and Ketman-SEAL Framework: Detection Mechanisms, Confirmed Outcomes, and Ethereum Foundation Disclosures
The mechanism works as follows: The Ethereum Foundation funded and coordinated the Ethereum Rangers program with a mandate to highlight the active presence of North Korean crypto IT workers within Ethereum ecosystem projects, and tasked the Kitman Project and SEAL to co-author an identification framework capable of tagging behavioral, technical, and identity-based indicators consistent with known worker patterns in the DPRK.
source: I’m leaving
Over the course of the six-month operating window, the program produced four key results – recovering $5.8 million, reporting more than 785 vulnerabilities, identifying more than 100 DPRK customers, and a documented trail of incident responses across dozens of affected projects. The Ethereum Foundation Ecosystem Support Program described the result as “a decentralized defense for a decentralized network.”
Blockchain investigator Nick Bax played a parallel role outside the official program structure, independently identifying and notifying more than 30 project teams that DPRK-related workers were on their active payrolls, and coordinating the freeze of hundreds of thousands of dollars in cryptocurrency that these clients had already received. The foundation’s statement that the work “directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today” is notable for its framing: This is an ongoing threat that requires active detection infrastructure, not a resolved historical anomaly.
It is necessary to note the state of knowledge of many details here: the specific identification methodology used by the Ketman and SEAL projects has not been publicly published in full, and the 53 affected projects have not been named. The $5.8 million recovery amount covers funds recovered in all ETH Rangers activities, not exclusively North Korea-related cases. The number of 100 represents discoveries within the scope of the Ethereum software ecosystem and should not be read as an upper limit for the total infiltration of the DPRK crypto industry.
The criminal enforcement dimension adds a separate layer of evidence. The two convicted US citizens – who pleaded guilty to wire fraud and money laundering conspiracy charges – received $700,000 for their role in funneling millions in revenue from victim US companies to accounts controlled by North Korea. Eight other defendants charged in connection with the same scheme remain at large, according to the Justice Department. The Justice Ministry announced the ruling on April 16 – a date that, the ministry noted, coincided with the birthday of the founder of the Democratic People’s Republic of Korea, Kim Il Sung.
explores: Best meme coins to watch – updated CoinSpeaker rankings
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to provide accurate and timely information but should not be considered financial or investment advice. Since market conditions can change rapidly, we encourage you to verify the information yourself and consult with a professional before making any decisions based on this content.
Daniel Francis is a technical writer and Web3 educator specializing in macroeconomics and DeFi mechanics. A crypto native since 2017, Daniel brings his background in cross-chain analytics to author evidence-based reports and detailed guides. It is certified by the Blockchain Council and is dedicated to providing “information gain” that cuts through the market noise to find blockchain’s real-world utility.
