Author: Unchained Crypto

Translated by: Deep Tide TechFlow

Deep Tide Guide: A Korean-American journalist disguised as a recruiter conducted a video interview with a suspected North Korean state-level hacker. The individual had solid technical skills, could read developer documentation in real-time to answer impromptu questions, claimed to be from Singapore but spoke with a Korean accent, and stated that his favorite Disney movie was "Frozen." As the interview reached the last question, "Please say something bad about Kim Jong-un," he was silent for a moment and exited Zoom.

As a Korean-American, my ancestors had to escape from Pyongyang. North Korea has always been a place of complex allure for me.

So, when North Korean security expert Taylor Monahan and Nick Bax from SEAL Alliance and Ump Labs asked me if I wanted to personally interview a North Korean crypto developer applying to Ump Labs, I agreed without hesitation.

For years, North Korea's top hackers have been stealing cryptocurrency for the dictatorship, with TRM Labs estimating the total amount exceeding $6 billion. Even established companies like Consensys have accidentally hired what the FBI and the U.S. Department of Justice referred to as "North Korean IT workers."

In 2024, CoinDesk first reported how rampant this issue was within the industry—well-known projects like Cosmos Hub, Fantom, Sushi, and Yearn Finance have unknowingly hired North Korean state-level hackers.

As Monahan mentioned in a recent episode of the Uneasy Money podcast: "Every mid-sized crypto company has had infiltration by North Korean IT workers at least since 2020. Many companies have even had as many as ten at the same time."

When I took on this task, my primary goal was to get that developer to say something negative about North Korean dictator Kim Jong-un. This is considered the "Kryptonite" for North Koreans; the vast majority of North Korean developers would immediately terminate the interview when asked to do so.

For an American who can openly tell President Trump to "get lost" on Twitter, it's almost absurd that North Koreans can't even fulfill such a simple request. But that's how a dictatorship maintains power, through brainwashing to control people's thoughts, isolating them from all external information, and then enforcing discipline with brutal physical punishment. According to the international NGO Liberty in North Korea, "even the slightest criticism of Kim Jong-un can lead to an entire family spending the rest of their lives in a political prison camp."

Even though I have known this for over a decade, I still wanted to witness this moment happen in real life.

Background

Monahan and Bax showed me a document listing the IT worker's Github account, various online accounts linked to his email, his work experience across multiple crypto projects like GameSwap, MetaPlay, and Cook Protocol, as well as on-chain connections between his cryptocurrency wallet transactions and other North Korean transactions with his employers. The document also included a screenshot—an announcement purportedly released by a team he hacked, featuring his profile photo.

While these were all accusatory in nature, the various clues were tightly connected. Later, I joined a video call and confirmed he was indeed the person in that hacker announcement photo, which was linked to those email addresses, profiles, and crypto wallet addresses.

These identity details appeared accurate and verifiable (of course, one must note that North Korean IT workers sometimes maintain specific GitHub accounts as a team), but there were two discrepancies. First, he claimed to live in Long Beach, California; second, he said his English name was Justin Lim. (He also used another alias, Jikun Liao; considering this surname is Chinese, it is very likely fabricated or borrowed.) The location he claimed provided a lead that I could tug on to try and expose him.

Privileged Yet Unfree

His online presence in any form already set him apart from the vast majority of his North Korean compatriots—who are not only banned from using the internet but most don't even have access to the domestic intranet. Even the smartphones provided by the North Korean government don’t allow free browsing of the internal network. In this "hermit kingdom," ordinary North Koreans can face execution, forced labor, or public denunciation for any contact with external media.

Another aspect that made him stand out is that some of his online profiles suggest he might be residing in Vladivostok, Russia. His compatriots are not permitted to live overseas and even require permits for domestic travel.

But on closer inspection, it makes sense that he has these privileges; he is a North Korean state-level hacker, a "honor" that only the elite can attain.

Two Koreans Pretending to be Chinese

Bax and Monahan revealed an interesting detail: this person allegedly stole about $2.7 million from MetaPlay in 2022. So he indeed has substantial skills. I was a bit worried he might see through my act of being a real recruiter and figure out that I was a journalist, possibly even hacking into my system to find out who I was.

Bax helped draft interview questions and guided me on what constituted appropriate responses so I could react and follow up sensibly. We also discussed which video conferencing platform could ensure my safety without using a VPN and came up with a name for my recruitment role: Sophie Wang.

It's quite amusing to think about—we, two Koreans, both using fake Chinese surnames to disguise our identities.

I was both excited and nervous, about to face "my" hacker (at least through a screen). Nick set up a work email for me at Ump Labs and scheduled the Zoom call for Friday at 2 PM (Eastern Time), which was Saturday at 4 AM for him (Vladivostok time); this timing was strange but made sense considering the nature of his work resembles forced labor. After rehearsing with Bax, I felt ready.

Cold-Blooded Criminal or Expressionless Worker?

The moment arrived. I finally had a virtual face-to-face with someone I imagined as a heartless scoundrel, a thief, a North Korean "IT worker."

However, my first impression was of a quiet, introverted young man with a doll-like face, wearing headphones, the microphone buzzing, working under fluorescent lights, looking like a customer service center employee. He seemed to be about 22 years old.

I first tossed out some casual icebreaker questions that Bax and I had prepared to try to find a flaw in his claimed Long Beach address. But I found it difficult to apply pressure on these questions since they were essentially chit-chat; I didn't want to come off as interrogative right away, as that would expose my identity.

For example, I asked him how the weather was in Long Beach, what was happening in Los Angeles lately, and whether he had been to Disney. Then I pretended I wasn't sure if California's Disney was called Disney Land or Disney World to see if he could help clarify. He spoke in single words throughout, and he completely missed the Disney reference.

I asked him what he liked to do in his spare time, and he replied, "shopping," though this answer was a bit odd, it wasn't a flaw I could expose right then.

He came off more as a detached, even emotionless techie. At one point, I even suspected he might be reading from a script. The only seemingly personal detail was that he mentioned liking to play Dota 2. But then again, could that just be made up to make him seem like an ordinary programmer? Regardless, my overall feeling was that he was merely trying to survive, or one could say, he was just doing his "job"—getting hired and then sending money back to the North Korean dictatorship.

Bax and Monahan were eager for me to ask him what his favorite Disney movie was and had informed me in advance that "Frozen" seemed to be the most common answer among North Korean developers. Sure enough, Lim confirmed that his favorite Disney movie was "Frozen."

He told me he was from Singapore. This was quite funny because his accent when he said "window shopping" was distinctly Korean, but I decided not to call him out on it. I was still in a session, waiting for the climax to arrive.

No Wonder These North Korean Developers Get Hired

Next, Iwent through the pretended recruitment process for Ump Labs. My conclusion was that he might indeed be a quite capable blockchain engineer. He proudly discussed how he solved a problem where The Graph's indexing speed on the Velas network couldn't keep up with the block processing speed, asserting that he forked the Velas network to make it compatible with The Graph.

What impressed me was not only that he seemed to know the answers to my questions, but also when I asked about OpenSea's Seaport protocol, he openly admitted he wasn't familiar with it and then pulled up developer documentation on the spot to analyze it in real time to answer my question.

He clearly wanted the job. Another question he admitted he didn't know about was Uniswap v4, saying he was familiar with v2 and v3, then proactively offered to check the v4 documentation.

Still a Hacker Expert?

He was quite adaptable on the spot. Because Ump Labs was building a physical goods trading platform, he provided some rather creative impromptu responses.

Of course, one possibility is that he was just very good at using AI-assisted answers. But aside from those few questions, he seemed to have most of his responses come straight from the heart.

Then it was time for the security-related questions. These were designed by Bax, as North Korean personnel seem to implement theft by understanding how project funds are protected. Lim responded that the smart contract's owner should use a multi-signature wallet, and then began to propose various ideas for protecting the smart contract's security, like preventing re-entrancy attacks.

At this point, I said, "You should know that the crypto industry has suffered a major attack. North Korea stole $1.5 billion from Bybit." Although I couldn't capture it due to issues with my recording setup, I saw a fleeting smile on his face—the only time throughout the whole conversation.

The Moment I Have Been Waiting For

Bax and I saved all the potentially tricky questions for the end so that we could gather as much information as possible before he might leave.

First, I asked him if he could personally fly to ETH Denver. He said he could but wanted to work remotely for a few months first.

Then it was time for my "Holy Grail question." I worded it very cautiously. As a descendant of ancestors who believed communism was unworkable and fled from today’s North Korea to a democratic society, as an American journalist who believes freedom of speech is one of the most important pillars of democracy, I intentionally chose the word "dictatorship" to describe the North Korean government. This was my way of trying to open a door in his mind, so perhaps one day he would question the cruel, barbaric, inhumane regime he was born into.

So, at what I thought was potentially my final question, I said, "As I mentioned earlier, the crypto industry has experienced significant infiltration by North Koreans representing a dictatorship, so we must conduct a fundamental check. Can you say something negative about Kim Jong-un?"

Silence. Then he very faintly said something like, "I think it's not..." or "I think it's enough." Then he disappeared.

I emailed him, pretending he had dropped out, asking if he could rejoin the Zoom. Nine minutes later, he responded to "me" (that is, Sophie Wang): "Hi Sophie, my network is unstable today and I can't do video calls right now. If you can share your Discord or Telegram, we can chat there. Thanks."

Bax, Monahan, and I quickly figured out how to get Sophie a new Telegram account. After setting it up, I reached out to Lim again—his username was Zero Bit—and he asked what the pay was for a Solidity developer at Ump Labs. After I replied, I once again asked him to say something negative about Kim Jong-un. He replied, "I don't know much."

I explained that it didn’t require any specific knowledge—he just needed to say something negative about Kim Jong-un. After a few minutes of silence, he wrote, "It's quite a special question, and I have never faced it with other teams before." (This seemed very likely to be an AI-generated response).

In any case, he was still trying to sidestep the request. I didn’t reply, and after a while, he probably reported or blocked me. I later found that the Telegram account created for Sophie Wang had become unusable, so I couldn’t screenshot or save it. (Fortunately, I had been messaging Bax and Monahan to synchronize every detail.)

A Heavy Conclusion

I agreed to do this "undercover" work out of an almost pathological curiosity—could he really not say a single bad word about Kim Jong-un? After my curiosity was satisfied, what remained was a feeling of sad shock. Meanwhile, I felt grateful to my ancestors—especially my grandfather, for his foresight; I also felt grateful for the freedom of speech we Americans enjoy.

This experience has also convinced me further that as long as every crypto company ensures to ask this one question during hiring, there should be no more North Korean developers being hired. These individuals would truly abandon all efforts.

If this is achieved, the North Korean regime would no longer be able to gain intelligence to steal cryptocurrency through internal infiltration. It's a basic check, yet it could save the entire industry and the world a tremendous hassle. I hope crypto companies worldwide use this question in their hiring calls, preventing North Korea's nuclear weapons program from obtaining even a penny of funding from cryptocurrency.

As for Justin Lim, or whatever your real name is, I hope one day you and your compatriots can gain freedom from the brutal tyranny of the Kim family.