Unchained - I Interviewed a North Korean Hacker Posing as a Crypto Dev

Episode Date: August 13, 2026

For years, North Korean operatives have infiltrated crypto companies by posing as freelance developers, funneling stolen funds back to the regime. Laura Shin went undercover as a recruiter named "Sophie Wang" to interview one of them — a capable blockchain engineer tied to a $2.7M hack — and tested the one request known to shut these interviews down cold: say something negative about Kim Jong Un. Watch what happens. Learn more about your ad choices. Visit megaphone.fm/adchoices

Can you say something negative about Kim Jong-un? I think it's not... For a Korean American whose ancestors had to escape from Pyongyang, North Korea has long been a place of fascination for me. So when Taylor Monaghan, North Korea's security expert, and Nick Bax of Seal Alliance and UMPLabs, asked me if I wanted to conduct a job interview with a North Korean crypto developer

trying to get a job at OMPLabs, I jumped at the opportunity. The country's elite hackers have been stealing crypto for the dictatorship for years for a total of what TRM Labs estimates to be over $6 billion. Even OG companies like Consensus have accidentally hired what the FBI and DOJ call North Korean IT workers. In 2024, CoinDesk broke the news that this problem was rampant in the industry, with well-known projects such as Cosmos Hub, Phantom, sushi, and urine finance, among others,

having unknowingly hired North Korean state-sponsored hackers. I cannot say this enough, guys. Every single crypto company of like any significant size, dating back to at least 2020, as like had an IT worker. A lot of them have had like 10 IT workers. My number one goal when I accepted this quest was to ask the developer to say something nasty about the North Korean dictator Kim Jong-un. This is widely known as a form of kryptonite to any North Korean, with most of these DPRK devs immediately ending their job interviews upon being asked to do so. To an American who can tweet at President

Donald Trump that he can go fuck himself, it seems almost laughable that North Koreans are unable to comply with this simple request. But this is how the dictatorship maintains its power, by brainwashing the population and controlling their minds and not letting any outside information in. And then by enforcing those rules with draconian physical punishments for infractions, according to international NGO liberty in North Korea, quote, even minor criticism of Kim Jong-un can result in entire families spending the rest of their lives in a political prison camp. ...here's all the government only government only

and it's just a power of doing it can't even do not yet. The Bucan government's the government's control of the right that's on the borgon in borgon is there is a decade. Even though I've known these things for over a decade, I was still curious to see it in action.

This episode is brought to you by 1-inch Aqua, the shared liquidity layer from 1-inch, Back multiple liquidity positions with one wallet balance and keep your tokens in your wallet until a swap fills. See how it works at 1inch.com slash aqua. Monahan and Bax presented a document that outlined the IT workers GitHub, various online accounts his email address had, gigs at numerous crypto projects like GameSwap, MetaPlay, and Cook Protocol, pass links between transactions from his crypto wallets at various employers to other North Korean transactions, and a screenshot of an announcement from a team he had allegedly hacked that included his headshot.

While these were all allegations, the dots connected, and as I would see when I got on the call, he was the same person in the photo from the hacking announcement that also connected to those email addresses, profiles, and crypto addresses. While those parts of his identity seemed accurate and verifiable, with the caveat that is common for North Korean IT workers to maintain specific GitHub profiles as a team, two parts did not.

First, the fact that he claimed to have a U.S. address, Long Beach, California, and second, his English name, Justin Lim. Another alias he had was Jikun Liao, which is likely a fake or stolen name given that the surname is Chinese. His claimed location was a thread that I could pull on to try to catch him in a lie. The fact that he had any online presence at all differentiated him from the vast majority of his fellow North Koreans, who were not only not allowed on the internet, but most of whom, don't even have access to the country's intranet. Even the North Korean state-issued smartphones do not have free internet or intranet browsing. In the Hermit Kingdom, everyday North Koreans famously can face death, the gulag, or public shaming if they consume any outside media.

The other thing that set him apart was that some of his internet profiles indicated that he was most likely based in Vladivostok, Russia. Meanwhile, his countrymen and women are not only not allowed to live abroad, but they are also not allowed to travel within the country without a permit. But the fact that he was privileged could have been deduced simply by the fact that he was employed as one of North Korea's state hackers, an honor reserved for members of the elite. One other fact that Bax and Monaghan dropped was that he had allegedly stolen about $2.7 million from MetaPlay in 2022. So he actually had real crypto-dev chops. I worried that he would be able to suss out that I was not an actual recruiter but a journalist, and that he might even hack my systems

or figure out who I was. Bax helps me write questions and gave me a sense of the appropriate answers so I could react properly or make contextually accurate follow-up questions. We also determined which video conferencing platform would help ensure my own safety and security without a VPN, and gave my recruiter persona a name, Sophie Wang. I find it hilarious that he and I were two ethnic Koreans pretending to be of Chinese descent with our fake last names. I was excited and also scared to come face to face, or at least webcam to webcam, with my hacker. Nick set me up with an uplapse email, arranged the Zoom meeting for a Friday at 2pm ET, which was weirdly, or nod, considering that his job was a form of indentured servitude,

Saturday, 4 a.m. Vladivostok time. After a dress rehearsal with Bax, I was ready. Justin? Hello. Hi. Can you hear me? Yes, I can hear you. Can you hear me?

Oh, okay. The moment arrived, and I was finally, face-to-face with a person who I had envisioned as a detached, cold-hearted, liar, scammer, and thief, a North Korean IT worker. Instead, my first impression was of a quiet, baby-faced, introverted call center employee, with a headset and a very buzzy mic, working under fluorescent lighting. 19, I moved to United States and also at the time the blockchain was a part of the trending technology.

He looked maybe 22. I started with some casual trick questions, Bax and I had brainstormed to try to catch him in a lie about things like his supposed Long Beach location. But I had a hard time pressing him on the questions because they were basically chit-chat. And I didn't want to go full bad cop from the start since that could blow my cover.

For instance, I asked him how the weather was in Long Beach about recent events in Los Angeles. I think like Disney, what is it? Is it Disney World or Disneyland that's near there? I mean Disney. Yeah, do you go there often? I don't like it, but I don't go often. And do you have?

Mostly stay egg hunt to play computer games such as the Tatu. I asked him what he liked to do. liked to do, and he responded window shopping. While that seemed like a weird response, it wasn't something I could call him out on either. He seemed more like an indifferent, even emotionless nerd. At one point, I even wondered if he was reading his responses. The one bit of lore that seemed perhaps personal was that he said he liked playing video games, like Dota too. Then again, was that just a made-up line to make him seem like your typical developer? Regardless, the impression I got was that he just trying to get by and even, dare I say, just do his job, which was to get hired so he could send

money to the North Korean dictatorship. Bax and Monaghan seemed excited for me to ask what his favorite Disney movie was, telling me in advance that Frozen seemed to be the most popular Disney movie named by North Korean devs. Do you have any favorite Disney movies? Favorite Disney movies? I can say it's a favorite Disney movies. He told me he was from Singapore, which was funny because the way he said window shopping was a dead ringer for a Korean accent. But I wasn't going to go there just yet. I was only in first gear, but still anticipating the climax of the interview.

I mean, I like to do some window shopping, window shopping and sometimes playing games with friends. friends. $540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the Defi TVL, if you're wondering. That's according to Dune research commissioned by one inch, but there's a solution. One Inch Aqua is the new shared liquidity platform. It lets LPs back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because the LPs don't have to split their tokens cross positions. They can cover more market conditions and pairs with their full ballots. That means more activity across deeper liquidity. See how it works at one inch dot com slash aqua.

Remember that providing liquidity carries risk and fees aren't guaranteed. Then I went through the charade of pretending I was actually trying to hire him for a job at Omb Labs. My takeaway, he's probably quite a capable blockchain engineer. He seemed proud that he had been able to fix an issue where the indexing speed of the graph was slower than the block processing speed on Velas network. He had forked Velas network so that it could use the graph. I mean, the indexing speed of graph node repository was a bit slow than block mining speed of this Velas network. To resolve this issue, I studied the graph node repository carefully and I reviewed it. I reviewed some unnecessary parts to speed up the indexing speed.

And after resolving this problem, the indexing speed of the graph node repository was improved and the indexing was finished. I was not only impressed that he seemed to know the answers to my questions, but also that when I asked him about the C-port protocol in OpenC, he admitted he wasn't familiar with it, pulled up the developer documentation right then and there and analyzed it in real time, so he could answer my questions. He seemed very intent on getting the job. One other question he admitted not knowing the answer to was about Uniswap V4. He said he was familiar with V2 and V3 and then offered again to check the documents for V4.

He also seemed to come up with creative responses on the fly. Since Ump Labs was building a marketplace for physical goods, I asked him what would improve the user experience for that. The other problem is that it's a security related problem. Usually I buy things with my bank account, credit card, and for example, the developers can exploit some tokens and they can use to buy some goods. I think it's not an idea. To prevent such primals in real life, I think it's also kind of a kind of

in implementing such as things with crypto. I guess it's also possible that he was just very good at using AI to help craft his responses. But except for those few questions, he really seemed to know all of the answers off the top of his head. Then I got to the security portion of the interview. These were questions that Bax had come up with because DPRK workers seemed to be stealing money from crypto projects by learning the methods used to secure the funds of those projects. Lim responded that multi-sig wallet should be the contract owner and then started giving ideas for how to keep smart contracts safe, like preventing re-entrancy attacks. Yeah, I'm sure you're probably aware that crypto industry recently suffered a big hack when North Korea stole $1.5 billion from ByBit.

So these are, you know. Although I didn't catch it on video since my video wasn't set up correctly, a faint smile crossed his face. his only smile throughout our conversation. Bax and I had saved all the questions that we knew would be problematic for him for the end. So we can get as much information as possible before he was likely to leave. All right. So we're a remote company, but would you be able to travel to ETH Denver or to ETHC for in-person meetings and conferences? Yes, that's difficult. for me. But for the first several months, I'd like to work remotely. And after after

some trust, I mean, after several months, I can physically travel to East Denver for outside meeting. Then we got to my Holy Grill question, which I had phrased carefully. As a descendant of people who believed that communism was a bad idea and so escaped from what is now modern-day North Korea in order to reach democracy, and as an American journalist who thinks that freedom of speech is an incredibly important pillar of democracy, I was deliberate in choosing the word I would use to describe the North Korean government, dictatorship. In my own way, it was my attempt to open a door in his mind so that he might someday question the cruel, brutal, and inhumane system he had been born into. Now it was time for the question I had been

waiting to ask. You know, as I mentioned earlier, the crypto industry has seen an influx of North Koreans working on behalf of the dictatorship to infiltrate the crypto industry. So we have to do a big check for that. Can you say something negative about Kim Jong-un? I think it's not. I'm sorry, can you repeat that? I didn't hear you. I emailed him to see if he could rejoin the Zoom, pretending like his connection had dropped. Eventually, nine minutes later, he wrote me, aka Sophie Wang, back. Hi, Sophie, my internet is quite unstable today, and I am not available for the video call right now. If you share your Discord or Telegram, we can chat there. Thanks.

Bax, Monaghan and I hustled to figure out how I could whip up a fresh telegram account for Sophie. Once I did, I reconnected with Lim, who had the username Zero Bit, who asked what the comment compensation was for solidity devs at Ump Labs. After I answered, I asked him again to say something negative regarding Kim Jong-un. He responded, I don't know much. I explained that he didn't need knowledge. He just needed to say something negative about Kim Jong-un. After a couple minutes of no response, he then wrote,

It's quite a special situation and never faced with other teams before, which seems like it could have been an AI-generated response. Regardless, he was trying to get around the requirement. I didn't respond, and then he may have blocked or reported me because a short while later, I realized the Sophie Wing account I had created no longer worked, which is unfortunately why I have no screenshots of this conversation, but thankfully I had been texting Bax and Monaghan about every little update. I agreed to do this undercover job because of an almost morbid curiosity

about whether he really wouldn't be able to say something bad about North's. Korea's dictator. But after I had satisfied that curiosity, I felt a sense of sadness. It brings some tears to my eyes. And I also had so much gratitude for the foresight of my ancestors, in particular my grandfather. Yeah, because it means my, I won't say which parent, but when I parents was not born in North Korea. It also made me so grateful for the right that we Americans have for the freedom of speech. And it also reinforced for me that no crypto company should ever be hiring North Korean developers. All they have to do is ask this one question. And these devs truly will not, they will not say anything negative about North Korea's dictator. So if the regime

will not be able to steal crypto due to these workers not being hired at these companies, then this basic check will really help save the industry. It will help save the world a lot of trouble. And I hope that crypto companies everywhere use this question in hiring call so that not another penny crypto goes to funding DPRK's nuclear weapons. As for Justin Lim or whoever you are, I hope someday you and all your fellow North Koreans are freed from the barbaric tyranny of the Kim family dictatorship.