Google Flags Rising North Korean Cyber Threat Targeting European Solana Projects
North Korean cyber operatives are stepping up their efforts to infiltrate European crypto companies—especially those building on the Solana blockchain—according to a recent report from Google Cloud.
The report outlines a growing pattern of North Korean “IT workers” masquerading as legitimate developers to gain employment at blockchain startups. Once inside, they seek access to sensitive infrastructure and data, which is then believed to be funneled back to the regime for revenue generation.
A notable case uncovered by Google involved a single operative juggling 12 fake identities across Europe and the U.S. This worker not only faked references and built relationships with recruiters but also used their own network of fabricated personas to endorse their credibility.
These actors aren’t just relying on deception—they have genuine technical skills. Google observed them contributing to projects using advanced frameworks like Next.js, CosmosSDK, and Rust, including the creation of a full Solana-based job marketplace and AI-enabled applications with blockchain functionality.
The trend marks a shift in strategy. Previously, most DPRK-linked cyber activity focused on U.S.-based companies. But tighter regulations and several high-profile indictments appear to have pushed these operatives toward less scrutinized European targets.
One major vulnerability lies in BYOD (bring your own device) environments, which Google says are being actively exploited by DPRK-linked developers.
The broader implications are significant. North Korean hacking groups remain one of the largest threats to the crypto ecosystem, stealing an estimated $1.3 billion in 2024 alone—and more than $1.5 billion in a single attack on Bybit in February 2025.
Google warns that with increasingly sophisticated tactics and a growing geographic footprint, the threat from DPRK-aligned IT workers is only becoming more complex and dangerous.
