Cryptocurrency Fraud
,
Cybercrime
,
Fraud Management & Cybercrime
Leaked Payment Server Data Lets Researchers Trace Money Flows
Greg Sirico •
July 22, 2026
The North Korean flag hanging in front of the Vladivostok, Russia, railway station before an April 2019 visit from North Korea leader Kim Jong Un. (Image: Shutterstock)
Salaries paid to North Korean IT workers end up converted to ammunition used against Ukraine, warns new research based on a trove of leaked payment server data.
See Also: Top 10 Technical Predictions for 2025
North Korea has for years smuggled remote and contract IT workers onto Western payrolls in a bid to boost the hard currency flowing into the poverty-stricken, totalitarian regime (see: How to Spot a North Korean Job Candidate).
Financial data tied to North Korea first posted by researcher ZachXBT in April offered a glimpse into North Korean transactional flows, laying bare a slew of intermediaries that funnel fraudulent IT worker money back to Pyongyang. Insider security firm DTEX in a Tuesday report said it was able to partially corroborate many of the findings. The leaked data included 390 IT worker accounts, chat logs and payment routing data.
One cryptocurrency wallet, controlled by administrator account PC-1234, processed $1.97 million in payments from North Korean IT workers between December 2025 and February 2026. DTEX linked the wallet to Ryongbong General Corporation, a North Korean defense conglomerate under U.S. sanctions.
Much of IT worker salaries go toward developing weapons of mass destruction. “The weapons program itself needs money and material inputs, and that funding traces back to revenue-generating operations, including the globally deployed IT worker networks and cryptocurrency theft operations,” said Michael “Barni” Barnhart, the report’s lead investigator.
But weapons development isn’t the only effort getting IT worker money, DTEX said. “Revenue from the IT worker stream does not stop at a resume scam or a payroll abuse story. It can feed a larger DPRK system that supports sanctioned entities, domestic state needs, and a Russia war effort that is actively consuming all facets of North Korean weapons and military support,” it wrote.
North Korea has deployed roughly 14,000 to 15,000 troops to Russian front lines in support of Moscow’s invasion of Ukraine in addition to sending other support such as construction workers and ammunition.
“For anyone still asking, ‘so what?’ or ‘is it really that bad?,’ follow the money,” DTEX wrote.
The leaked data showed the money most often moving to finance management Unit 1020, a financial management unit under Command 710, a previously undocumented bureau.
Barnhart said he’s also seen evidence of more crossover between North Korean IT workers and hackers. Overlap “is now far more pervasive than previously understood. Historically, overlaps were notable but rare,” he said.