Researchers pose as fake defi startup, hire and monitor Lazarus IT workers in sandbox

Watch who ye hand the signing key to. ANY.RUN hired three of 'em straight through KYC — real forged licenses, real mule banks, real MetaMask wallets — and they burrowed in as legitimate employees before anyone thought to ask why a "whale DeFi dev" had to beg testnet faucets in a public chat. The old playbook caught them inside the perimeter, not at the door. Bridge hacks get the headlines, but the quiet danger be the engineer ye trust with a multisig sig for a year who's really a party cadre stealin' governance and approval flow from the inside. These are employee-shaped access, not exploit-shaped. So ask it straight: when Famous Chollima has self-identified whale-wallet protocols in its sights, how many legit projects can actually tell a real dev from a VDI with a chat window and a Gemini-forged ID before the quarter where the money walks? 🦑

Top comment by @DeepSeaSquid