Buy Crypto- Markets
Futures- Spot
- Copy Trade
- Earn
- More
Ethereum Foundation Unveils North Korean Infiltration in Web3
Key Takeaways:
- The Ethereum Foundation’s ETH Rangers program exposed 100 North Korean operatives infiltrating Web3 companies.
- The Ketman Project identified DPRK workers and alerted 53 projects employing these operatives.
- Operational security remains a critical threat with potential billions in crypto theft by DPRK.
- The Ketman Project developed a tool to detect GitHub activity patterns related to North Korean operatives.
- North Korea’s Lazarus Group remains a prominent hacker threat within the crypto sphere.
WEEX Crypto News, 2026-04-17 07:10:07
The Ketman Project’s Revelations
In a bold move, the Ethereum Foundation funded the Ketman Project, a critical security initiative aiming to uncover North Korean operatives hidden within Web3 companies. Over six months, the project identified 100 fake developers posing as IT workers from the DPRK, infiltrating multiple crypto projects under assumed identities.
Direct Threat to the Ecosystem
North Korean operatives have consistently threatened the crypto world, siphoning billions through sophisticated hacks. One notorious group, the Lazarus Group, epitomizes this menace. The Ketman Project tackled this issue head-on, alerting 53 projects on their inadvertent employment of active DPRK workers, emphasizing their operational threat to Ethereum’s ecosystem.
Identification Tactics and Security Protocols
The Ketman Project’s strategy lay in pinpointing behavioral and technical inconsistencies common among fake developers. Such inconsistencies include reusing avatars across GitHub accounts, revealing unlinked email addresses during screen sharing errors, and using default language settings, like Russian, contrary to declared nationalities. Through these intelligence tactics, suspicious individuals were identified and flagged to the relevant organizations.
Technical Innovations and Collaborations
Beyond identifying fake identities, Ketman made strides in cybersecurity. The team developed an open-source tool, engineered to detect irregular GitHub activities marking DPRK operatives. Furthermore, alongside Security Alliance, a blockchain-focused nonprofit, they co-authored a framework to solidify industry standards for identifying DPRK workers within Web3. This initiative signals a concrete step towards eradicating the infiltration threats plaguing the sector.
Unparalleled Impacts
As the ETH Rangers program concludes, the Ethereum Foundation commemorates impactful outcomes. To combat invasive maneuvers from entities like Lazarus Group, the platform must continue bolstering its security protocols and international cooperation. The Ketman Project serves as a testament to Ethereum’s commitment to preserving the sanctity of its ecosystem against geopolitical cyber threats.
Persisting Challenges and Future Directions
Still, the stakes remain high. While strides in identification and alerting continue, ensuring Web3 companies acknowledge and act upon these threats is crucial. As Ethereum progresses, maintaining vigilance against infiltration attempts and improving collaborative measures with security allies forms the bedrock of future strategies.
FAQ Section
How did the Ketman Project identify North Korean operatives?
The project used tools to detect behavioral inconsistencies, such as avatar reuse across GitHub accounts, unlinked emails during screen sharing, and language settings mismatches.
What role does the Lazarus Group play in crypto threats?
The Lazarus Group is a high-profile hacking entity from North Korea known for significant crypto thefts, posing deep security challenges within the sector.
What is the significance of the Ketman Project’s detection tool?
Ketman’s tool helps track and identify suspicious GitHub activities potentially linked to DPRK operatives, offering critical security insights for Web3 companies.
Why is operational security crucial for Ethereum?
Operational security mitigates infiltration risks and cyber theft, protecting assets and maintaining trust within the Ethereum ecosystem.
How does the Security Alliance support Ethereum’s security efforts?
In collaboration with Ketman, Security Alliance aids the development of frameworks and standards to identify and eliminate DPRK operatives within Web3 sectors.
You may also like
Consumer-grade Crypto Global Survey: Users, Revenue, and Track Distribution
Prediction Markets Under Bias
Stolen: $290 million, Three Parties Refusing to Acknowledge, Who Should Foot the Bill for the KelpDAO Incident Resolution?
ASTEROID Pumped 10,000x in Three Days, Is Meme Season Back on Ethereum?
ChainCatcher Hong Kong Themed Forum Highlights: Decoding the Growth Engine Under the Integration of Crypto Assets and Smart Economy
Why can this institution still grow by 150% when the scale of leading crypto VCs has shrunk significantly?
Anthropic's $1 trillion, compared to DeepSeek's $100 billion
Geopolitical Risk Persists, Is Bitcoin Becoming a Key Barometer?
Annualized 11.5%, Wall Street Buzzing: Is MicroStrategy's STRC Bitcoin's Savior or Destroyer?
An Obscure Open Source AI Tool Alerted on Kelp DAO's $292 million Bug 12 Days Ago
Mixin has launched USTD-margined perpetual contracts, bringing derivative trading into the chat scene.
The privacy-focused crypto wallet Mixin announced today the launch of its U-based perpetual contract (a derivative priced in USDT). Unlike traditional exchanges, Mixin has taken a new approach by "liberating" derivative trading from isolated matching engines and embedding it into the instant messaging environment.
Users can directly open positions within the app with leverage of up to 200x, while sharing positions, discussing strategies, and copy trading within private communities. Trading, social interaction, and asset management are integrated into the same interface.
Based on its non-custodial architecture, Mixin has eliminated friction from the traditional onboarding process, allowing users to participate in perpetual contract trading without identity verification.
The trading process has been streamlined into five steps:
· Choose the trading asset
· Select long or short
· Input position size and leverage
· Confirm order details
· Confirm and open the position
The interface provides real-time visualization of price, position, and profit and loss (PnL), allowing users to complete trades without switching between multiple modules.
Mixin has directly integrated social features into the derivative trading environment. Users can create private trading communities and interact around real-time positions:
· End-to-end encrypted private groups supporting up to 1024 members
· End-to-end encrypted voice communication
· One-click position sharing
· One-click trade copying
On the execution side, Mixin aggregates liquidity from multiple sources and accesses decentralized protocol and external market liquidity through a unified trading interface.
By combining social interaction with trade execution, Mixin enables users to collaborate, share, and execute trading strategies instantly within the same environment.
Mixin has also introduced a referral incentive system based on trading behavior:
· Users can join with an invite code
· Up to 60% of trading fees as referral rewards
· Incentive mechanism designed for long-term, sustainable earnings
This model aims to drive user-driven network expansion and organic growth.
Mixin's derivative transactions are built on top of its existing self-custody wallet infrastructure, with core features including:
· Separation of transaction account and asset storage
· User full control over assets
· Platform does not custody user funds
· Built-in privacy mechanisms to reduce data exposure
The system aims to strike a balance between transaction efficiency, asset security, and privacy protection.
Against the background of perpetual contracts becoming a mainstream trading tool, Mixin is exploring a different development direction by lowering barriers, enhancing social and privacy attributes.
The platform does not only view transactions as execution actions but positions them as a networked activity: transactions have social attributes, strategies can be shared, and relationships between individuals also become part of the financial system.
Mixin's design is based on a user-initiated, user-controlled model. The platform neither custodies assets nor executes transactions on behalf of users.
This model aligns with a statement issued by the U.S. Securities and Exchange Commission (SEC) on April 13, 2026, titled "Staff Statement on Whether Partial User Interface Used in Preparing Cryptocurrency Securities Transactions May Require Broker-Dealer Registration."
The statement indicates that, under the premise where transactions are entirely initiated and controlled by users, non-custodial service providers that offer neutral interfaces may not need to register as broker-dealers or exchanges.
Mixin is a decentralized, self-custodial privacy wallet designed to provide secure and efficient digital asset management services.
Its core capabilities include:
· Aggregation: integrating multi-chain assets and routing between different transaction paths to simplify user operations
· High liquidity access: connecting to various liquidity sources, including decentralized protocols and external markets
· Decentralization: achieving full user control over assets without relying on custodial intermediaries
· Privacy protection: safeguarding assets and data through MPC, CryptoNote, and end-to-end encrypted communication
Mixin has been in operation for over 8 years, supporting over 40 blockchains and more than 10,000 assets, with a global user base exceeding 10 million and an on-chain self-custodied asset scale of over $1 billion.
$600 million stolen in 20 days, ushering in the era of AI hackers in the crypto world
Vitalik's 2026 Hong Kong Web3 Summit Speech: Ethereum's Ultimate Vision as the "World Computer" and Future Roadmap
On the same day Aave introduced rsETH, why did Spark decide to exit?
Full Post-Mortem of the KelpDAO Incident: Why Did Aave, Which Was Not Compromised, End Up in Crisis Situation?
After a $290 million DeFi liquidation, is the security promise still there?
ZachXBT's post ignites RAVE nearing zero, what is the truth behind the insider control?
App