North Korea’s cyber and financial theft efforts are increasingly relying on remote workers based in third countries, according to a report published by NBC. The scheme reportedly involves recruiting foreign IT workers—such as people located in Iran and Lebanon—to help North Korean-linked actors infiltrate US companies and route funds back to the DPRK in support of its weapons programs.

The renewed focus on “outsourced” digital labor comes after a July alert issued by the US government and multiple foreign agencies, warning that North Korean IT workers actively seek contracts with the aim of remitting salaries to parent agencies in North Korea. The alert also described these workers as potential insider threats, including roles in data exfiltration and cryptocurrency theft.

Key takeaways

• US and partner agencies warned in July that DPRK-linked IT workers use employment contracts to funnel pay back to North Korean agencies.
• NBC reports North Korea is using remote workers from third countries—reportedly including Iran and Lebanon—to pass job interviews and gain access to US firms.
• After contracts are obtained, NBC says North Korean operatives often take over the positions.
• The reported tactics extend to cryptocurrency theft, with some candidates allegedly being offered crypto compensation for part-time work.
• Broader reporting ties North Korea’s cyber operations to large crypto losses, underscoring how persistent these campaigns can be.

A US warning highlights contract-driven infiltration

The July alert cited by NBC frames the DPRK’s approach as more than typical hacking. Instead, it emphasizes how North Korean-linked IT workers attempt to gain entry through normal business channels—seeking contracts and leveraging employment relationships to access internal systems.

According to the alert, these workers “seek out contracts with the intent of remitting their salaries to their parent North Korean agencies.” It also describes them as posing an insider threat to companies, with participation in data exfiltration and cryptocurrency theft, as well as the theft of sensitive information. That combination points to a multi-stage method: gain a role legitimately or semi-legitimately, then convert that access into monetizable outcomes and compromised data.

Third-country remote staffing as a growing tactic

NBC reports that as governments have moved to counter DPRK efforts, the strategy has shifted toward recruiting remote IT workers from outside North Korea. The report says foreign workers are scouted—NBC specifically mentions LinkedIn—as North Korean-linked actors attempt to recruit people who can pass initial screening and interviews for remote positions.

Once those work contracts are obtained, NBC says the remote workers are typically followed by a transfer of control, with the roles then “usually” taken over by North Korean operatives. For firms hiring contractors—particularly those operating across borders—this is an important nuance: the risk is not only external malware or credential theft. It also includes what happens after a contractor is onboarded and gains legitimate access to development environments, internal documentation, or payment-related workflows.

NBC also reports that some of the foreign recruits were offered cryptocurrency—about $500 monthly in at least one case—in exchange for part-time work, described as “interview associates.” That detail matters for compliance teams: it suggests intermediated recruitment and payment schemes may be used to normalize crypto transfers in otherwise ordinary hiring processes.

The July alert’s themes—remittance intent, insider-threat potential, and links to crypto theft—appear consistent with what NBC portrays as a practical hiring pipeline. If implemented as described, the scheme reduces friction for DPRK actors by blending into legitimate commercial operations while still creating pathways to exfiltrate data and move value.

Crypto losses connected to DPRK activity remain substantial

The hiring/infiltration angle is part of a broader pattern that has repeatedly surfaced in cybersecurity reporting. Cointelegraph previously reported in May, citing CrowdStrike, that North Korean state-affiliated hackers were responsible for more than $2 billion in crypto losses in 2025—an estimated 51% increase year-on-year.

While the NBC report focuses on recruitment and insider access, the continued magnitude of crypto losses—per the CrowdStrike-cited figure—suggests that monetization channels (including cryptocurrency-related theft) remain a central goal. In practice, insider positioning and data access can accelerate theft by expanding the target set: not only wallets and exchanges, but also internal systems that may contain credentials, private keys, payment rails, or proprietary information that can be leveraged for further attacks.

For crypto investors and market participants, this matters because large-scale theft and follow-on laundering attempts can affect confidence in compliance and custody systems, and they can increase perceived regulatory pressure on the broader industry. Even when theft is confined to specific victims, the ecosystem-level narrative tends to build around repeat offenders and persistent attack methods.

Sanctions pressures, but limited signs of economic slowdown

Alongside the cyber narrative, economic reporting suggests sanctions have not prevented North Korea from sustaining activity at home. Cointelegraph previously noted, citing the Bank of Korea, that North Korea’s GDP increased 3.5% in 2025 despite global sanctions.

That estimate doesn’t prove the cyber recruitment scheme directly caused macro outcomes—but it provides context for why such operations may remain attractive to the DPRK. If the country’s economy is not collapsing under sanctions, then actors may have continued resources and incentives to invest in complex infiltration strategies that require coordination across borders and jurisdictions.

From a risk-management perspective, this implies that defensive measures must be ongoing. If North Korea can adjust recruitment tactics—shifting to remote third-country workers and using crypto compensation for part-time roles—then security teams should expect further evolution in how these threats blend into normal business processes.

What companies should watch next

As the details reported by NBC and the July alert suggest contract-based insider risk tied to crypto remittances, the most urgent question for employers and vendors is how these schemes will be detected in practice. Firms should track warning signals around contractor onboarding—especially scenarios involving unusually fast access to sensitive systems, crypto-focused payment arrangements, or patterns consistent with insider takeover after initial screening—while cybersecurity and compliance teams closely monitor how DPRK-linked recruiting methods develop.

Ben Delo, a co-founder of the BitMEX cryptocurrency exchange and a prominent UK crypto figure, has donated £36 million (about $49 million) to Nigel Farage’s Reform UK, according to reports from the DPA and other UK media. The payment is described as the largest single donation ever made to a British political party.

Delo said the contribution was intended to help Reform UK ensure a “fair fight” in the run-up to the next stage of voting. The move lands amid an ongoing UK political debate about whether donations and gifts tied to the crypto industry can distort elections and how lawmakers should regulate them.

Key takeaways

• Ben Delo reportedly gave £36 million to Reform UK, the biggest political-party donation in the UK, according to DPA and other media.
• Delo frames the donation as a way to enable a “fair fight” at the polls.
• Reform UK’s earlier major crypto-linked donors included Christopher Harborne, who previously gave £9 million.
• UK politicians have been debating whether to impose a permanent ban or moratorium on crypto donations in response to the Farage donation controversy.
• Delo’s background includes prior US federal charges tied to the Bank Secrecy Act; he later received a presidential pardon, according to prior reporting.

Why the £36 million donation is drawing scrutiny

The reported £36 million donation by Ben Delo gives fresh fuel to concerns about the influence of digital-asset wealth in British elections. It also intensifies a controversy that has already prompted investigations and parliamentary fallout.

Earlier reporting from Cointelegraph said Farage was under investigation after receiving millions of dollars’ worth of donations and gifts from figures connected to the crypto sector, including Christopher Harborne and George Cottrell. Delo’s latest contribution is therefore not happening in a vacuum—it follows a sequence of political and legal developments that have put the spotlight on how the UK treats crypto-related political funding.

For investors and builders in the crypto industry, the political implications are not abstract. Election funding that draws from large, market-aligned fortunes can shape the policy environment affecting digital asset regulation, compliance expectations, and future tax or licensing rules.

Reform UK’s fundraising and the “fair fight” rationale

Delo reportedly said he donated the money to ensure a “fair fight” at the polls. Farage responded by expressing confidence in Reform UK and describing the party as the only one capable, in his view, of reversing the country’s economic decline.

The scale of the donation also contrasts with earlier fundraising milestones for Reform UK. Cointelegraph previously noted that Delo’s fellow crypto-linked donors included Harborne, who gave £9 million to the party last August, making him the second-largest donor behind Delo’s reported contribution.

According to The Telegraph, the £36 million was structured as £1 million per month up to the general election in 2029, but Delo made the full payment upfront so it could not be blocked. That detail matters because the controversy around crypto donations in the UK has increasingly focused not only on who funds political parties, but also on how such funding is timed and administered.

Investigation backdrop: resignation, by-election, and lawmakers’ response

In July, Nigel Farage resigned his position as a Member of Parliament amid the crypto donation scandal, which triggered a by-election that Reform UK won with 63% of the vote—ahead of a satirical candidate, Count Binface, as described in prior coverage.

Cointelegraph previously reported that Labour MPs were considering making a moratorium on crypto donations—announced in March and pending legislation—permanent in response to the situation Farage described as “gifts” from Harborne and Cottrell. The reported Delo donation adds new pressure to those discussions, because it demonstrates that large-scale political funding tied to crypto-linked wealth can continue even as lawmakers weigh whether existing rules are adequate.

More broadly, the case highlights a tension in UK political life: the desire to attract legitimacy and investment while also addressing concerns that opaque or poorly understood funding channels could undermine public trust in democratic processes.

Delo’s legal history and what the pardon means for the political debate

Ben Delo’s political visibility is also tied to his legal history in the United States. Cointelegraph previously reported that Delo, one of three BitMEX co-founders, pleaded guilty to federal charges related to violations of the Bank Secrecy Act. Cointelegraph also reported that Delo agreed to pay a $10 million fine in 2022 and did not serve prison time.

Importantly for context, earlier reporting also states that Delo and his colleagues Arthur Hayes and Samuel Reed received a pardon from US President Donald Trump in March 2025. While a pardon does not erase prior conduct in the public record, it can change how figures are perceived legally and politically, including their ability to participate openly in public life and major funding decisions.

For UK lawmakers trying to decide on permanent restrictions, the Delo case underscores a practical dilemma: regulating political influence often requires judgments about risk, reputation, and compliance—rather than relying only on the presence or absence of formal convictions.

What to watch next

As Reform UK faces fresh attention following the reported £36 million donation, the key question is whether UK lawmakers move beyond debate toward binding, enforceable rules on crypto-linked political funding. Readers should watch for signs of whether the proposed permanent moratorium evolves into legislation—and how parties and donors respond to any new compliance expectations.

The challenge is not simply producing more food. Agricultural production has increased in Africa over the last few decades, but growth isn’t necessarily durable. Agri-food supports two-thirds of African livelihoods and generates a third of the continent’s GDP. But farmers generate less value than their counterparts elsewhere: about $1,500 per worker annually versus $4,300 globally, according to figures from AGRA, the organization formerly known as the Alliance for a Green Revolution in Africa. Higher profits mean more farmers can afford to stay in the business and younger people will be enticed to join, thereby creating a more sustainable food system for the continent. 

Profitable farming isn’t just about feeding people, as important as that is. A developed agriculture sector creates opportunities for investment in processing, trading, and other functions along the agriculture value chain, leading to further economic growth opportunities. Only around 12-15% of Africa’s agricultural GDP comes from processing, compared to more than 60% in developed regions, according to AGRA. And agricultural outputs can be the basis of new industries: think of biofuels. From a climate perspective, too, higher profits create adaptive capacity. Farmers with margin can invest in irrigation, improved seeds, better soil health, or simply absorb a bad season.

The AfD won voters away from all its mainstream rivals, winning over 82,000 voters who had previously supported the governing Christian Democratic Union of Germany (CDU). But one of the more striking consequences of the Sept. 6 election in Saxony-Anhalt was that the AfD energized people who had stopped voting, and brought 170,000 of them—around a tenth of the local electorate—back to the ballot box. These are people who had largely given up on politics, and who, for years, have inhabited a parallel universe. Many of these voters regard Germany’s Nazi past as overblown and refuse to draw parallels between then and now. They also see centrist politics as the instrument of a deep state seeking to undermine their values.

While reporting from Saxony-Anhalt, I was reminded of a small incident I witnessed before the pandemic. I was walking along a street in Leipzig, one of the main cities of the former Communist East Germany, with a helpful contact, an intelligent local activist who had once worked for the Greens. As we passed the offices of MDR, the regional public broadcaster, she suddenly shouted, without provocation, “Lügenpresse”—“lying press,” or “fake news.” Startled, I asked what the station had done to earn her ire. “They don’t listen to the likes of me,” was all she could say. The more I pressed her to identify the specific source of her grievance, the more agitated she became.