{"id":11838,"date":"2026-08-13T07:31:10","date_gmt":"2026-08-13T07:31:10","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=11838"},"modified":"2026-08-13T07:31:10","modified_gmt":"2026-08-13T07:31:10","slug":"reporter-poses-as-vc-to-expose-suspected-north-korean-crypto-operatives","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=11838","title":{"rendered":"Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives"},"content":{"rendered":"<p><\/p>\n<div>\n<div id=\"blockquote-block_0cc4dda869b7a5eecc48528e1add115f\" class=\"blockquote-container\" style=\"border-color: #5100fc\">\n<div class=\"blockquote-text\">\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The investigation used a controlled fake workplace to observe suspected operatives\u2019 identities, tools, working habits and online infrastructure.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Researchers uncovered questionable identity documents, location-masking technology, AI-assisted work and servers associated with malware families linked to North Korean campaigns.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A reporter\u2019s simulated investor role formed part of the deception, which eventually ended when researchers challenged workers over their documents.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p class=\"wp-block-paragraph\">Cybersecurity researchers used a fake cryptocurrency company to investigate three developers they believe were North Korean operatives, with a reporter joining the deception by posing as a venture capital investor. The fabricated business, Ballena Azul, was presented as a decentralised finance startup, while its systems were designed to monitor the developers\u2019 activity.<\/p>\n<p class=\"wp-block-paragraph\">Mauro Eldritch and Heiner Garc\u00eda recruited the suspected workers through a GitHub-linked intermediary and gave them access to virtual machines that recorded their actions. The developers claimed to live in the United States and provided identification and banking information that researchers said raised questions about their identities. Among the findings were a New York licence belonging to another person and an image that researchers said had been processed using Google Gemini.<\/p>\n<p class=\"wp-block-paragraph\">During one stage of the investigation, a Cointelegraph reporter joined a Zoom call while impersonating Aelin Ashriver, an investor working for the fictional Definitive Communications.\u00a0 The reporter acted as though Ballena Azul was seeking investment and even suggested the company might receive media coverage.\u00a0<\/p>\n<p class=\"wp-block-paragraph\"><strong>Related: Australia Eyes Crypto Tax Shake-Up as CGT Discount Changes Loom<\/strong><\/p>\n<h2 id=\"h-following-the-workers-digital-trail\" class=\"wp-block-heading\">Following the Workers\u2019 Digital Trail\u00a0<\/h2>\n<p class=\"wp-block-paragraph\">The researchers observed the workers using AstrillVPN to obscure their apparent locations, alongside remote-access software, cryptocurrency wallets and tools for transferring two-factor authentication codes. They also found extensive use of artificial intelligence, with ChatGPT helping with coding and basic technical problems and Gemini used for image alteration and document forgery.<\/p>\n<p class=\"wp-block-paragraph\">The operation also exposed servers that researchers associated with infrastructure previously linked to malware campaigns. When the deception ended, researchers confronted two workers over their documents, prompting them to leave the video meeting. The reporting noted that the workers\u2019 nationality and affiliation could not be independently confirmed and had not been publicly identified by a government agency.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Related: AUSTRAC Shuts Down Cryptolink\u2019s 96 Crypto ATMs Over Compliance Failures<\/strong><\/p>\n<\/p><\/div>\n<p>Cryptocurrency,North Korea,Security#Reporter #Poses #Expose #Suspected #North #Korean #Crypto #Operatives1786606270<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The investigation used a controlled fake workplace to observe suspected operatives\u2019 identities, tools, working habits and online infrastructure. Researchers uncovered questionable identity documents, location-masking technology, AI-assisted work and servers associated with malware families linked to North Korean campaigns. A reporter\u2019s simulated investor role formed part of the deception, which eventually ended when researchers challenged workers<\/p>\n","protected":false},"author":1,"featured_media":11839,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[62,379,1137,3401,6226,6225,6224,3755],"class_list":["post-11838","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","tag-crypto","tag-expose","tag-korean","tag-north","tag-operatives","tag-poses","tag-reporter","tag-suspected"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=11838\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives\" \/>\n<meta property=\"og:description\" content=\"The investigation used a controlled fake workplace to observe suspected operatives\u2019 identities, tools, working habits and online infrastructure. Researchers uncovered questionable identity documents, location-masking technology, AI-assisted work and servers associated with malware families linked to North Korean campaigns. A reporter\u2019s simulated investor role formed part of the deception, which eventually ended when researchers challenged workers\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=11838\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-13T07:31:10+00:00\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11838\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=11838\",\"name\":\"Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11838#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11838#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/controlled-investigation.jpg\",\"datePublished\":\"2026-08-13T07:31:10+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11838#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=11838\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11838#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/controlled-investigation.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/controlled-investigation.jpg\",\"width\":1920,\"height\":1080},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11838#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=11838","og_locale":"en_US","og_type":"article","og_title":"Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives","og_description":"The investigation used a controlled fake workplace to observe suspected operatives\u2019 identities, tools, working habits and online infrastructure. Researchers uncovered questionable identity documents, location-masking technology, AI-assisted work and servers associated with malware families linked to North Korean campaigns. A reporter\u2019s simulated investor role formed part of the deception, which eventually ended when researchers challenged workers","og_url":"https:\/\/cryptonews.uk.com\/?p=11838","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-08-13T07:31:10+00:00","author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=11838","url":"https:\/\/cryptonews.uk.com\/?p=11838","name":"Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=11838#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=11838#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/controlled-investigation.jpg","datePublished":"2026-08-13T07:31:10+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=11838#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=11838"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=11838#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/controlled-investigation.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/controlled-investigation.jpg","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=11838#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Reporter Poses as VC to Expose Suspected North Korean Crypto Operatives"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11838"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11838\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/11839"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}