What’s It Like to Hire a North Korean ‘IT Worker’? I Interviewed One

For a Korean-American whose ancestors had to escape from Pyongyang, North Korea has long been a place of fascination for me. 

So when Taylor Monahan, North Korea security expert, and Nick Bax of SEAL Alliance and Ump Labs asked me if I wanted to conduct a job interview with a North Korean crypto developer trying to get a job at Ump Labs, I jumped at the opportunity. 

The country’s elite hackers have been stealing crypto for the dictatorship for years — for a total of what TRM Labs estimates to be over $6 billion. Even OG companies like Consensys have accidentally hired what the FBI and DOJ call North Korean “IT workers.” 

In 2024, CoinDesk broke the news that this problem was rampant in the industry, with well-known projects such as Cosmos Hub, Fantom, Sushi, and Yearn Finance, among others, having unknowingly hired North Korean state-sponsored hackers.

As Monahan said on a recent episode of Uneasy Money, “ Every single crypto company of any significant size dating back to at least 2020 has had an IT worker. A lot of them have had 10 IT workers.”

My number one goal when I accepted this quest was to ask the developer to say something nasty about the North Korean dictator, Kim Jong Un. This is widely known as a form of kryptonite to any North Korean, with most of these DPRK devs immediately ending their job interviews upon being asked to do so. 

To an American who can tweet at President Donald Trump that he can go fuck himself, it seems almost laughable that North Koreans are unable to comply with this simple request. But this is how the dictatorship maintains its power — by brainwashing the population and controlling their minds and not letting any outside information in … and then by enforcing those rules with draconian physical punishments for infractions. According to International NGO Liberty in North Korea, “Even minor criticism of Kim Jong-un can result in entire families spending the rest of their lives in a political prison camp.” 

Even though I’ve known this for over a decade, I was still curious to see it in action. 

The Backstory

Monahan and Bax presented a document that outlined the IT worker’s Github, various online accounts his email address had, gigs at numerous crypto projects like GameSwap, MetaPlay and Cook Protocol, past links between transactions from his crypto wallets at various employers’ to other North Korean transactions, and a screenshot of an announcement from a team he had allegedly hacked that included his headshot. 

While those were all allegations, the dots connected, and as I would see when I got on the call, he was the same person in the photo from the hacking announcement that also connected to those email addresses, profiles, and crypto addresses. 

While those parts of his identity seemed accurate and verifiable (with the caveat that it’s common for North Korean IT workers to maintain specific GitHub profiles as a team), two parts did not. First, the fact that he claimed to have a U.S. address — Long Beach, California — and second, his English name: Justin Lim. (Another alias he had was Jikun Liao, which is likely a fake or stolen name, given that the surname is Chinese.) His claimed location was a thread that I could pull on to try to catch him in a lie.

Both Privileged and Unprivileged

The fact that he had any online presence at all differentiated him from the vast majority of his fellow North Koreans, who are not only not allowed on the internet, but most of whom don’t even have access to the country’s intranet. Even the North Korean state-issued smartphones do not have free internet — er, intranet — browsing. In “The Hermit Kingdom,” everyday North Koreans famously can face death, the gulag or public shaming if they consume any outside media.  

The other thing that set him apart was that some of his internet profiles indicated that he was most likely based in Vladivostok, Russia. Meanwhile, his countrymen and women are not only not allowed to live abroad, but they are also not allowed to travel within the country without a permit. 

But the fact that he was privileged could have been deduced simply by the fact that he was employed as one of North Korea’s state hackers — an honor reserved for members of the elite.

Two Koreans Pretending to Be Chinese

One other fact that Bax and Monahan dropped was that he had allegedly stolen about $2.7 million from MetaPlay in 2022. So he actually had real crypto dev chops. I worried that he would be able to suss out that I was not an actual recruiter but a journalist — and that he might even hack my systems or figure out who I was.

Bax helped me write questions and gave me a sense of the appropriate answers so I could react properly or make contextually accurate followup questions. We also determined which video conferencing platform would help ensure my own safety and security without a VPN, and gave my recruiter persona a name: Sophie Wang. 

I find it hilarious that he and I were two ethnic Koreans pretending to be of Chinese descent with our fake last names. 

I was excited and also scared to come face to face (or at least webcam to webcam) with “my” hacker. Nick set me up with an Ump Labs email, arranged the Zoom meeting for a Friday at 2pm ET (which was, weirdly — or not, considering that his job was a form of indentured servitude — Saturday, 4am Vladivostok time). After a dress rehearsal with Bax, I was ready.

Hardened Criminal or Baby-Faced Automaton?

The moment arrived, and I was, finally, face to face — virtually — with a person who I had envisioned as a detached, cold-hearted liar, scammer, and thief: a North Korean “IT worker.” 

Instead, my first impression was of a quiet, baby-faced, introverted call center employee with a headset and a very buzzy mic, working under fluorescent lighting. He looked maybe 22.

I started with some casual trick questions Bax and I had brainstormed to try to catch him in a lie about things like his supposed Long Beach location, but I had a hard time pressing him on the questions, because they were basically chitchat, and I didn’t want to go full bad cop from the start, since that could blow my cover. 

For instance, I asked him how the weather was in Long Beach, about recent events in Los Angeles, whether he ever went to Disney — and then I pretended not to know whether it was called Disney Land or Disney World in California to see if he could fill in the blank. He gave one-word answers, and didn’t respond to my question about the name of the Disney amusement park. 

I asked him what he liked to do and he responded, “window shopping.” While that seemed like a weird response, it wasn’t something I could call him out on either. 

He seemed more like an indifferent, even emotionless nerd. At one point I even wondered if he was reading his responses. The one bit of lore that seemed perhaps personal was that said he liked playing video games like Dota 2. Then again, was that just a made-up line to make him seem like your typical developer? Regardless, the impression I got was that he was just trying to get by, and even, dare I say, just do his job, which was to get hired so he could send money to the North Korean dictatorship. 

Bax and Monahan seemed excited for me to ask what his favorite Disney movie was, telling me in advance that Frozen seemed to be the most popular Disney movie named by North Korean devs. Lim delivered, confirming that his favorite Disney movie was indeed Frozen. 

He told me he was from Singapore, which was funny, because the way he said “window shopping” was a dead ringer for a Korean accent, but I wasn’t going to go there yet. I was only in first gear, but still anticipating the climax of the interview. 

No Wonder These North Korean Devs Get Hired

Then I went through the charade of pretending I was actually trying to hire him for a job at Ump Labs. My takeaway: he’s probably quite a capable blockchain engineer. He seemed proud that he had been able to fix an issue where the indexing speed of the Graph was slower than the block processing speed on Velas network. He had forked Velas network so that it could use The Graph. 

I was not only impressed that he seemed to know the answers to my questions, but also that when I asked him about the Seaport protocol on OpenSea, he admitted he wasn’t familiar with it, pulled up the developer documentation right then and there, and analyzed it in real time, so he could answer my questions. 

He seemed very intent on getting the job. One other question he admitted not knowing the answer to was about Uniswap v4. He said he was familiar with v2 and v3, and then offered again to check the documents for v4. 

Or Was He a Hacking Mastermind?

He also seemed to come up with creative responses on the fly. Since Ump Labs was building a marketplace for physical goods, 

I guess it’s also possible that he was just very good at using AI to help craft his responses, but except for those few questions, he seemed to know all the answers off the top of his head. 

Then I got to the security portion of the interview. These were questions that Bax had come up with because DPRK workers seemed to be stealing money from crypto projects by learning the methods used to secure those projects’ funds. Lim responded that multisig wallets should be the contract owner and then started giving ideas for how to keep smart contracts safe, like preventing re-entrancy attacks. 

At this point, I said, “ I’m sure you’re probably aware the crypto industry suffered a big hack when North Korea stole $1.5 dollars from Bybit.” Although I didn’t catch it on video since my video wasn’t set up correctly, a faint smile crossed his face — his only smile throughout our conversation. 

The Moment I Had Been Waiting For

Bax and I had saved all the questions that we knew would be problematic for him for the end, so we could get as much information as possible before he was likely to leave. 

First, I asked him if he could travel to ETH Denver. He said yes, but that he’d like to work remotely for several months first. 

Then, we got to my holy grail question, which I had phrased carefully. As a descendant of people who believed that communism was a bad idea and so escaped from what is now modern-day North Korea in order to reach democracy, and as an American journalist who thinks that freedom of speech is an incredibly important pillar of democracy, I was deliberate in choosing the word I would use to describe the North Korean government: dictatorship. In my own way, it was my attempt to open a door in his mind so that he might someday question the cruel, brutal and inhumane system he had been born into. 

So for what I believed was likely to be my final question, I asked him, “ As I mentioned earlier, the crypto industry has seen an influx of North Koreans working on behalf of the dictatorship to infiltrate the crypto industry, so we have to do a basic check for that. Can you say something negative about Kim Jong Un?”

There was a silence. Then he very faintly said, “I think it’s not …” or “I think it’s enough” or something like that. Then he was gone. 

I emailed him to see if he could rejoin the Zoom, pretending like his connection had dropped. Eventually, nine minutes later, he wrote “me” (aka Sophie Wang) back: “Hi Sophie, My internet is quite unstable today and I am not available for the video call right now. If you share your Discord or Telegram, we can chat there. Thanks.” 

Bax, Monahan and I hustled to figure out how I could whip up a fresh TG account for Sophie. Once I did, I reconnected with Lim, who had the username Zero Bit, who asked what the compensation was for Solidity devs at Ump. After I answered, I asked him again to say something negative regarding Kim Jong Un. He responded, “I don’t know much.” 

I explained that he didn’t need knowledge – he just needed to say something negative about Kim Jong Un. After a couple minutes of no response, he then wrote, ”It’s quite special question, and never faced with other teams before” — which seems like it could have been an AI generated response. 

Either way, he was still trying to get around the requirement. I didn’t respond, and then he may have blocked or reported me, because a short while later, I realized the Sophie Wang account I had created no longer worked, which is why I have no screenshots. (Thankfully, I’d been texting Bax and Monahan about every little update.)

A Sober Ending 

I agreed to do this undercover job because of an almost morbid curiosity about whether he really wouldn’t be able to say something bad about North Korea’s dictator, but after I had satisfied it, I felt a sense of sad disbelief. I also had so much gratitude for the foresight of my ancestors, in particular my grandfather, and for the right that we Americans have to the freedom of speech. 

It also reinforced for me that no crypto company should ever be hiring North Korean developers if they always make sure to ask this one question. These devs truly will abandon all effort. 

If so, the regime will not be able to steal crypto due to inside knowledge gained. It’s a basic check that will save the industry and the world a lot of trouble. I hope that crypto companies everywhere use this question in hiring calls so that not another penny of crypto goes to funding DPRK’s nuclear weapons. 

As for Justin Lim, or whoever you are, I hope someday you and all your fellow North Koreans are someday freed from the barbaric tyranny of the Kim family dictatorship.