On-chain analyst Tay said on X that developers allegedly linked to North Korea were involved in building more than 40 DeFi protocols, naming projects such as SushiSwap, Thorchain, Yearn Finance, Fantom, and Harmony. The issue is not limited to theft allegations. Tay argued that these individuals were embedded in teams and helped build core infrastructure used by major protocols.
How the claims resurfaced on X
The discussion gained traction after another account described a job interview with a candidate later connected to the Lazarus Group. According to that account, the applicant showed strong technical ability, passed standard screening, and joined video calls, but dropped out when later interviews required travel. Tay used that example to argue that state-linked operators may enter crypto startups through normal hiring channels rather than only through direct attacks.
Drift Protocol was cited as a recent case. Tay said a state-affiliated agent had worked inside the team for six months before a major exploit in April 2024. The report did not present that as proven causation, but it did frame the case as a sign that sophisticated actors may be able to stay inside crypto companies for long periods without detection.
Well-known protocols appeared on the list
Tay said the workers often had credible backgrounds on paper, and claims such as “seven years of blockchain development” were not simply fabricated. In Tay’s account, these developers were technically capable, could clear interviews, and produced meaningful code. That is what makes the allegations more serious: the concern is not just access, but influence over development and security processes.
When asked about the financial impact, Tay estimated that at least $6.7 billion had been siphoned from the crypto industry through efforts involving DPRK-linked individuals operating inside legitimate firms and projects. The article attributed that figure to Tay’s estimate and did not cite an independent audit or official total.
Tay also gave more detail on several names in the list. Harmony was mentioned in connection with an embedded developer who later helped users affected by compromised wallets, while a separate hacking group carried out a major incident involving the protocol. Beanstalk was also referenced, with the distinction that workers tied to the project were not necessarily the same people who executed actual exploits.
In SushiSwap’s case, Tay pointed to a developer known as Eratos, also referred to as Anthony Keller or Daiki Saito. Tay said earlier research had already flagged links between that individual and North Korea, citing documentation from chollima-group.io, a site focused on DPRK cyber operations.
Regulators were already tracking DPRK IT networks
The article noted that the U.S. Treasury’s Office of Foreign Assets Control, or OFAC, took action in 2024 against several people and entities tied to DPRK IT worker networks. OFAC inquiries found that workers using false identities had generated hundreds of millions of dollars by securing jobs at crypto companies around the world.
Tay’s thread pushes the concern beyond payroll fraud. The claim is that these actors may have helped shape development and security at protocols widely used across DeFi. That has reopened questions around contributor vetting, internal controls, and how early-stage crypto teams detect long-term infiltration before it reaches production code.