The Ethereum Foundation revealed on Thursday that its six-month ETH Rangers program – run in collaboration with the Ketman Project and the Security Alliance (SEAL) – detected approximately 100 computer scientists linked to the Democratic People’s Republic of North Korea embedded in 53 crypto projects, while simultaneously recovering $5.8 million in funds and exposing more than 785 vulnerabilities. helping DPRK agents pose as US-based developers to infiltrate around 100 domestic companies.
We think this is less a story about a foundation’s security program and more a structural signal about the depth of state-sponsored labor infiltration in the crypto hiring pipeline — and how poorly most projects are equipped to detect it.
The ETH Rangers program is complete and the results speak for themselves: over $5.8 million recovered, over 785 vulnerabilities reported, over 100 DPRK agents identified, and much more.
A decentralized defense for a decentralized network.
Read the full recap 👇
– EF Ecosystem Support Program (@EF_ESP) April 16, 2026
The industry exposure here is not primarily technical. This is a procedural matter: verification gaps in remote recruitment, insufficient background checks, and a lack of project-level sanctions compliance infrastructure have collectively created the conditions under which DPRK workers can operate for months – or years – before being detected.
DISCOVER: Best Crypto to Buy Right Now – Updated Guide from CoinSpeaker
ETH Rangers Program and Ketman-SEAL Framework: Detection Mechanisms, Confirmed Results, and What the Ethereum Foundation Disclosed
The mechanism works as follows: The Ethereum Foundation funded and coordinated the ETH Rangers program with a mandate to surface the active presence of North Korean crypto IT workers in Ethereum ecosystem projects, tasking the Ketman Project and SEAL with co-writing an identification framework capable of reporting behavioral, technical, and identity-based indicators consistent with known patterns of DPRK workers.
Source: Ketman
During its six-month operating period, the program produced four major results: $5.8 million recovered, more than 785 vulnerabilities reported, more than 100 DPRK agents identified, and a documented record of incident responses in dozens of affected projects. The Ethereum Foundation Ecosystem Support Program described the result as “a decentralized defense for a decentralized network.”
Blockchain investigator Nick Bax played a parallel role outside the formal structure of the program, independently identifying and informing more than 30 project teams that DPRK-linked workers were on their active payroll, and coordinating the freezing of hundreds of thousands of dollars in crypto already received by these agents. The Foundation’s statement that the work “directly addresses one of the most pressing operational security threats facing the Ethereum ecosystem today” is notable for its framing: it is an ongoing threat requiring active detection infrastructure, not a historical anomaly that has been resolved.
It is necessary to emphasize the epistemic status of several details here: the specific identification methodology used by the Ketman and SEAL project has not been made public in its entirety, and the 53 projects involved have not been named. The $5.8 million recovered covers funds recovered across all ETH Rangers activities, not exclusively in DPRK-related cases. The number of 100 operations represents detections within the program’s Ethereum ecosystem scope and should not be interpreted as an upper limit of the total infiltration of the DPRK crypto industry.
The criminal dimension adds a distinct layer of evidence. The two convicted U.S. nationals — who pleaded guilty to wire fraud and money laundering conspiracy — received $700,000 for their roles in moving millions of proceeds from victimized U.S. companies to DPRK-controlled accounts. Eight other defendants charged in the same scheme remain at large, according to the Justice Department. The DOJ announced the sentence on April 16 – a date that coincided, the department noted, with the birthday of DPRK founder Kim Il Sung.
EXPLORE: Best Coins to Watch – Updated Rankings from CoinSpeaker
following
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article is intended to provide accurate and current information, but should not be considered financial or investment advice. Because market conditions can change quickly, we encourage you to verify the information for yourself and consult a professional before making any decisions based on this content.
Daniel Frances is a technical writer and Web3 educator specializing in macroeconomics and DeFi mechanics. Hailing from crypto since 2017, Daniel leverages his experience in on-chain analytics to write evidence-based reports and in-depth guides. He holds certifications from the Blockchain Council and is dedicated to providing “insight gain” that overcomes market hype to find real utility for blockchain.
