everyone's calling the DPRK IT worker thing an HR problem. it's a KYC problem.

$800M funneled back to North Korea's weapons programs through operatives who passed identity verification at actual crypto companies.

OFAC sanctioned 6 individuals in March for orchestrating these networks. the details are rough. AI-generated profile photos passing liveness checks, stolen US identities with clean credit histories, voice changers on interview calls, payments split across dozens of wallets to stay under threshold reporting.

these aren't sophisticated nation-state zero days. they're the same fraud vectors we see in customer onboarding every day, just pointed at HR instead.

everyone on r/CryptoCurrency is treating this like a hiring security story. the controls that failed are identity verification controls. IP geolocation mismatches with stated residence, refusal to do live unscripted video, document authenticity checks that can't distinguish AI-generated docs from real ones.

if you run a VASP and your customer onboarding wouldn't catch someone presenting a synthetic identity with a clean stolen SSN and an AI-generated selfie, you have the same hole these companies had.

we've been screening wallets and running on-chain analytics for sanctions hits. the identity layer underneath all of it is basically held together with document uploads and liveness checks designed before generative AI existed.

idk what the fix looks like yet honestly.