The Ethereum Foundation identifies 100 state-sponsored hackers, including North Korean actors.

ChainCatcher report: The Ethereum Foundation recently released a summary report on the ETH Rangers security initiative, revealing that during a six-month security funding program, researchers identified approximately 100 suspected state- cyber actors, including infiltrators from North Korea who have been active across multiple Web3 projects. The report indicates that investigations were advanced through initiatives such as the “Ketman Project,” with researchers issuing alerts to around 53 blockchain projects, exposing how these actors used false identities to infiltrate development teams and participate in fund transfers and technical roles. Additionally, related funds totaling hundreds of thousands of dollars have been frozen. The security team has integrated this intelligence into its threat analysis framework for the Lazarus Group and disclosed findings at security conferences such as DEF CON, demonstrating that state- cyberattacks continue to penetrate cryptocurrency infrastructure. Overall, the program has resulted in the freezing or recovery of over $5.8 million in funds, the reporting or documentation of more than 785 vulnerabilities, and the handling of 36 security incidents—indicating that security threats to the Ethereum ecosystem have evolved from isolated vulnerability exploits to systemic risks involving state-level actors. Furthermore, the report notes that North Korean-linked hackers have infiltrated projects through methods such as “remote IT workers,” employing attack vectors including account takeovers, freelancing platform infiltration, and fund transfers, making them a top priority for industry defense. The Ethereum Foundation emphasized that securing decentralized networks requires “decentralized defense,” and will continue to support security research, threat intelligence, and talent development to counter escalating state- cyber threats.