Fraudulent tech workers with ties to North Korea are expanding their infiltration operations to blockchain firms outside the US after increased scrutiny from authorities, with some having worked their way into UK crypto projects, Google says.

Google Threat Intelligence Group (GTIG) adviser Jamie Collier said in an April 2 report that while the US is still a key target, increased awareness and right-to-work verification challenges have forced North Korean IT workers to find roles at non-US companies.

“In response to heightened awareness of the threat within the United States, they’ve established a global ecosystem of fraudulent personas to enhance operational agility,” Collier said. 

“Coupled with the discovery of facilitators in the UK, this suggests the rapid formation of a global infrastructure and support network that empowers their continued operations,” he added. 

Google’s Threat Intelligence Group says North Korea’s tech workers expanded their reach amid a US crackdown. Source: Google

The North Korea-linked workers are infiltrating projects spanning traditional web development and advanced blockchain applications, such as projects involving Solana and Anchor smart contract development, according to Collier. 

Another project building a blockchain job marketplace and an artificial intelligence web application leveraging blockchain technologies was also found to have North Korean workers. 

“These individuals pose as legitimate remote workers to infiltrate companies and generate revenue for the regime,” Collier said. 

“This places organizations that hire DPRK [Democratic People’s Republic of Korea] IT workers at risk of espionage, data theft, and disruption.”

North Korea looking to Europe for tech jobs

Along with the UK, Collier says the GTIG identified a notable focus on Europe, with one worker using at least 12 personas across Europe and others using resumes listing degrees from Belgrade University in Serbia and residences in Slovakia. 

Separate GTIG investigations found personas seeking employment in Germany and Portugal, login credentials for user accounts of European job websites, instructions for navigating European job sites, and a broker specializing in false passports.

At the same time, since late October, the North Korean workers have increased the volume of extortion attempts and gone after larger organizations, which the GTIG speculates is the workers feeling pressure to maintain revenue streams amid a crackdown in the US. 

“In these incidents, recently fired IT workers threatened to release their former employers’ sensitive data or to provide it to a competitor. This data included proprietary data and source code for internal projects,” Collier said. 

Related: North Korean crypto attacks rising in sophistication, actors — Paradigm

In January, the US Justice Department indicted two North Korean nationals for their involvement in a fraudulent IT work scheme involving at least 64 US companies from April 2018 to August 2024.

The US Treasury Department’s Office of Foreign Assets Control also sanctioned companies it accused of being fronts for North Korea that generated revenue via remote IT work schemes.

Crypto founders have also been reporting an increase in activity from North Korean hackers, with at least three founders reporting on March 13 that they foiled attempts to steal sensitive data through fake Zoom calls.

Having audio issues on your Zoom call? That’s not a VC, it’s North Korean hackers.

Fortunately, this founder realized what was going on.

The call starts with a few “VCs” on the call. They send messages in the chat saying they can’t hear your audio, or suggesting there’s an… pic.twitter.com/ZnW8Mtof4F

— Nick Bax.eth (@bax1337) March 11, 2025

In August, blockchain investigator ZachXBT claimed to have uncovered a sophisticated network of North Korean developers earning $500,000 a month working for “established” crypto projects.

Magazine: Lazarus Group’s favorite exploit revealed — Crypto hacks analysis

Kentucky’s finance watchdog has dismissed its lawsuit against Coinbase over the exchange’s staking rewards program, following its peers in Vermont and South Carolina.

Kentucky’s Department of Financial Institutions filed the stipulation to dismiss jointly with Coinbase on April 1, ending the state’s legal action against the exchange first filed along with 10 other state regulators in June 2023.

Coinbase chief legal officer Paul Grewal posted to X on April 1, calling for Congress “to end this litigation-driven, state-by-state approach with a federal market structure law.”

Source: Paul Grewal

Financial regulators from 10 states launched similar suits against Coinbase in June 2023, on the same day the Securities and Exchange Commission sued the exchange — a lawsuit the SEC dropped last month.

Seven suits against Coinbase still active

Alabama, California, Illinois, Maryland, New Jersey, Washington and Wisconsin are the seven states that are still continuing with their lawsuits, which all allege Coinbase breached securities laws with its staking rewards program.

Vermont was the first state to end its suit against Coinbase, with its Department of Financial Regulation filing an order to rescind the action on March 13, noting the SEC’s Feb. 27 decision to drop its action against the exchange and the likelihood of changes in the federal regulator’s guidance.

The South Carolina Attorney General’s securities division followed Vermont days later, dismissing its lawsuit in a joint stipulation with Coinbase on March 27.

Related: South Carolina dismisses its staking lawsuit against Coinbase, joining Vermont

Kentucky’s decision to drop its case against Coinbase follows just days after the state’s governor, Andy Beshear, signed a “Bitcoin Rights” bill into law on March 24 that establishes protections for crypto self-custody and exempts crypto mining from money transmitting and securities laws.

The axed state-level lawsuits come amid a stark policy change at the SEC, which has dropped or delayed multiple lawsuits against crypto companies that it filed under the Biden administration.

The federal securities watchdog has also created a Crypto Task Force that is engaging with the industry on how it should approach cryptocurrencies.

Magazine: SEC’s U-turn on crypto leaves key questions unanswered

Despite Bitcoin’s 2.2% gains on April 1, BTC (BTC) hasn’t traded above $89,000 since March 7. Even though the recent price weakness is often linked to the escalating US-led global trade war, several factors had already been weighing on investor sentiment long before President Donald Trump announced the tariffs.

Some market participants claimed that Strategy’s $5.25 billion worth of Bitcoin purchases since February is the primary reason BTC has held above the $80,000 support. But, regardless of who has been buying, the reality is that Bitcoin was already showing limited upside before President Trump announced the 10% Chinese import tariffs on Jan. 21.

Gold/USD (left) vs. Bitcoin/USD (right). Source: TradingView / Cointelegraph

The S&P 500 index hit an all-time high on Feb. 19, exactly 30 days after the trade war began, while Bitcoin had repeatedly failed to hold above $100,000 for the previous three months. Although the trade war certainly affected investor risk appetite, strong evidence suggests Bitcoin’s price weakness started well before President Trump took office on Jan. 20.

Spot Bitcoin ETFs inflows, strategic Bitcoin reserve expectations and inflationary trends

Another data point that weakens the relation with tariffs is the spot Bitcoin exchange-traded funds (ETFs), which saw $2.75 billion in net inflows during the three weeks following Jan. 21. By Feb. 18, the US had announced plans to impose tariffs on imports from Canada and Mexico, while the European Union and China had already retaliated. In essence, institutional demand for Bitcoin persisted even as the trade war escalated.

Part of Bitcoin traders’ disappointment after Jan. 21 stems from excessive expectations surrounding President Trump’s campaign promise of a “strategic national Bitcoin stockpile,” mentioned at the Bitcoin Conference in July 2024. As investors grew impatient, their frustration peaked when the actual executive order was issued on March 6.

A key factor behind Bitcoin’s struggle to break above $89,000 is an inflationary trend, reflecting a relatively successful strategy by global central banks. In February, the US Personal Consumption Expenditures (PCE) Price Index rose 2.5% year-over-year, while the eurozone Consumer Price Index (CPI) increased by 2.2% in March.

Investors turn more risk-averse following weak job market data

In the second half of 2022, Bitcoin’s gains were driven by inflation soaring above 5%, suggesting that businesses and families turned to cryptocurrency as a hedge against monetary debasement. However, if inflation remains relatively under control in 2025, lower interest rates would favor real estate and stock markets more directly than Bitcoin, as reduced financing costs boost those sectors.

US CPI inflation (left) vs. US 2-year Treasury yield (right). Source: TradingView

Related: Coinbase sees worst quarter since FTX collapse amid industry bloodbath

The weakening job market also dampens traders’ demand for risk-on assets, including Bitcoin. In February, the US Labor Department reported job openings near a four-year low. Similarly, yields on the US 2-year Treasury fell to a six-month low, with investors accepting a modest 3.88% return for the safety of government-backed instruments. This data suggests a rising choice for risk aversion, which is unfavorable for Bitcoin.

Ultimately, Bitcoin’s price weakness stems from investors’ unrealistic expectations of BTC acquisitions by the US Treasury, declining inflation supporting potential interest rate cuts, and a more risk-averse macroeconomic environment as investors turn to short-term government bonds. While the trade war has had negative effects, Bitcoin was already showing signs of weakness before it began.

This article is for general information purposes and is not intended to be and should not be taken as legal or investment advice. The views, thoughts, and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.