North Korea Hackers continue to trick a growing number of freelancers into having their verified accounts and identities used in transferring stolen crypto funds. What seems like an innocent online job offer usually turns out to be part of a global money-laundering scam.
Such hackers impersonate recruiters or employers with offerings of remote work but actually aim at hiding behind real people to clean their illegal crypto money.
While they used to create fake profiles for the purposes of landing jobs online, now they use actual freelancers. They contact people on well-known work sites such as Upwork, Freelancer, and GitHub, pretending to offer a simple task or tech job. Once someone accepts, they request to switch to Telegram or Discord for “onboarding.”

Source: Security Alliance
From there, they will instruct the person to install AnyDesk or Chrome Remote Desktop through which they take complete control of the freelancer’s computer. This allows them to log into verified accounts and, from that perspective, all activity appears to be performed by a real user in another country.
Having taken over a freelancer's computer, the hacker uses that person's ID and location to get remote jobs or open crypto-related accounts. Payments from those fake jobs flow into crypto wallets linked to North Korea, with the freelancer receiving just a small cut, usually about 20%.
Because hackers use real, verified accounts, platforms cannot easily detect them. This also helps them bypass KYC checks that normally block accounts coming from high-risk countries.
The main targets are freelancers from Asia, Europe, and the US, especially those with verified profiles. Many victims come from countries like the Philippines, Malaysia, and Ukraine. Some are tricked because they're looking for easy income, while others believe they're part of a real remote project.
The sad part is, most of these victims hardly realize that they are helping hackers in crypto laundering or commit other crimes until it's too late.
Experts say that this new method helps North Korea Hackers to grow quicker and remain hidden. With the usage of real people, they remain undetected and gain access to more systems across the world. Authorities mention that money from these scams often funds North Korea's missile and nuclear programs.
Never share your verified job accounts or ID with anyone.
Do not install remote access software for any recruiter or client.
Keep communication inside the freelance platform until everything is confirmed.
Report any recruiter who asks you to move money or handle crypto payments.
Freelancers have become easy targets for North Korea Hackers looking to move stolen crypto funds under the radar. These scams are getting smarter and harder to detect, but awareness can make a big difference. If you work online, always double-check who you're talking to, and never let anyone control your account or computer. Staying cautious could save your career-and protect you from unknowingly helping a global cybercrime network.
Muskan Sharma is a crypto journalist with 2 years of experience in industry research, finance analysis, and content creation. Skilled in crafting insightful blogs, news articles, and SEO-optimized content. Passionate about delivering accurate, engaging, and timely insights into the evolving crypto landscape. As a crypto journalist at Coin Gabbar, I research and analyze market trends, write news articles, create SEO-optimized content, and deliver accurate, engaging insights on cryptocurrency developments, regulations, and emerging technologies.