Inside the fake crypto startup that fooled North Korean IT workers

Suspected DPRK IT workers pitch for venture capital backing from the fictitious Definitive Communications, played by Cointelegraph. Source: ANY.RUN Eldritch and García built the fictitious Ballena Azul with infrastructure provided by cybersecurity platform ANY.RUN. An existing UK registration for an unrelated company of the same name, which was dissolved in 2022, added legitimacy to the project. Eldritch assumed the identity of co-founder “Leonardo Nelson,” while García took on the alias “Andy Jones” and posed as the company’s team lead. Related: North Korean cyber spies are no longer just remote threats One of the most valuable pieces of intel that the five-week ruse exposed were the external servers the workers used as intermediary points before connecting to Ballena Azul’s controlled virtual desktops. Exposed servers were particularly valuable because such infrastructure is often recycled across operations and can remain active for long periods. García tells Magazine the servers were associated with malware families linked to North Korean campaigns that steal credentials, crypto wallet data and other sensitive information. “Some of the servers we found were tied back to distributing InvisibleFerret and BeaverTail/OtterCookie in prior years and were active to this day,” he says. But some others were totally new and had zero intelligence about them, looking clean and keeping outside of mainstream block lists or threat feeds.” He adds that the infrastructure could serve multiple purposes, with servers previously used for malware distribution also acting as command-and-control infrastructure, and as proxies for operators carrying out their day-to-day work. The suspected workers do not need to deploy malware to pose a threat, according to the researchers. Once hired, they can gain legitimate access to a company’s internal systems, source code and other sensitive information. The longer they remain undetected, the longer they can continue drawing salaries that researchers say ultimately help fund the North Korean regime. The operation also showed the group relied on artificial intelligence tools to help compensate for gaps in their technical knowledge. They used ChatGPT for writing and coding, including to answer basic questions and complete assignments they struggled with themselves. They preferred Google Gemini for image alteration and document forgery. A suspected DPRK IT worker and ChatGPT team up in an attempt to obtain testnet crypto during the Ballena Azul operation. Source: ANY.RUN Other tools employed included remote desktop software, crypto wallets and a service for sharing two-factor authentication codes. North Korean IT workers have become a growing cybersecurity threat to the cryptocurrency industry. Consensys said in July that it had engaged a North Korea-linked developer through a third-party service provider before identifying the threat and cutting off access. In another case, US prosecutors charged four North Korean nationals in 2025 with using false identities to obtain remote IT jobs and allegedly stealing more than $900,000 in cryptocurrency from two companies, including a US blockchain research and development firm. The US Treasury said in March that North Korean IT worker schemes generated nearly $800 million in 2024 to help fund the Pyongyang regime’s weapons-of-mass-destruction programs. The ruse began when García connected with a recruiter via GitHub, who had been linked to Famous Chollima, a threat group associated with North Korean IT worker operations. García said that Ballena Azul needed to hire software developers and the recruiter offered up “Jack Anderson,” “Angelo Espree” and “Lucas Theo.” At least two of them presented US identification. The trio were given various programming assignments inside controlled virtual desktop environments, which allowed García and Eldritch to observe how they worked. Angelo Espree was one of the developers onboarded through a recruiter associated with DPRK operations. Source: ANY.RUN The researchers also deliberately introduced technical problems, including selective network outages and disappearing mouse cursors, to see how the suspected workers reacted and which tools they turned to when things went wrong. “Honestly, the biggest surprise was how much of it ran on improvisation,” García says. “There was no rigid playbook, no polished corporate process behind them.” During their many weeks working inside the controlled environments, the suspected North Koreans left behind a treasure trove for the researchers, including chat logs, AI conversations, crypto wallet information, VPN exit nodes and hours of live video footage. Their connections also exposed the servers that became one of the investigation’s most valuable findings. To be sure, the heavy AI reliance isn’t unique to the workers hoodwinked in Ballena Azul’s operation. Ballena Azul workers generally used AI as a crutch for coding and technical tasks they struggled with. Reuters reported Monday that another North Korean hacking group, Kimsuky, was using AI for a more offensive purpose. The group was reportedly running AI tools locally to help automate cyberattacks, analyze stolen data and produce more convincing phishing campaigns. This was not the first time Cointelegraph has played a minor role in exposing suspected North Korean workers. In February 2025, García and Cointelegraph conducted a job interview for a suspected operative calling himself “Motoki.” The developer claimed to be Japanese but ragequit the interview after being asked to introduce himself in his mother tongue. Still, García kept communicating with him. Motoki eventually offered to send García money to buy a computer that he could access remotely, allowing him to work through a local machine instead of connecting through a VPN to bypass restrictions used by employers and freelance platforms. Related: From Sony to Bybit: How Lazarus Group became crypto’s supervillain García later documented suspected North Korean operatives recruiting freelancers to provide verified accounts, identities and remote access to their computers. In one version of the scheme, operatives could work through machines physically located in the US, making them appear to employers and freelance platforms as US-based contractors. In May, two US “laptop farmers” - people who hosted a cluster of computers that North Koreans could remotely access - were sentenced to 18 months in prison for helping DPRK IT workers pose as US-based employees in schemes that generated more than $1.2 million and affected nearly 70 companies. All fake things must come to an end, so the researchers introduced “Benito Camella,” Ballena Azul’s co-founder, who had supposedly been focused on other business in Milan while the company expanded. When he returned, Camella confronted the workers over discrepancies in their identities and documents. The confrontation quickly began to clear the chat room. Espree left the video call first, while Anderson stayed longer before realizing the scheme was unraveling. “Are you living two lives, Mr. Anderson?” Camella asks Jack Anderson during the confrontation. Source: ANY.RUN But the researchers kept the deception going even after the meeting ended. In the company’s Telegram channel, the “CEO” accused “Andy Jones” of bringing in “illegal workers” and putting the company at risk. “Jones” responded that he had been under pressure to build a team quickly and was not being paid enough to do it. He maintained that he had done the best he could with what he had. The staged argument ended with the fake CEO terminating both their working relationship and friendship, keeping up the appearance that Ballena Azul had collapsed because of a disastrous hiring decision. One of the suspected North Koreans later contacted García privately to apologize for what had happened and ask whether he was all right. According to the researchers, they never heard from the rest of the group again. To this day, they say, the suspected workers do not know they wasted weeks working inside an environment built to extract intelligence from them. Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure? Editor’s note: Cointelegraph could not independently confirm the nationality or affiliation of the suspected DPRK IT workers, and no government agency has publicly identified them.