Google Alerts Solana Ecosystem: North Korean Hackers Targeting European Blockchain Projects

North Korean hackers are ramping up cyberattacks on blockchain initiatives across Europe—particularly those tied to the Solana network—according to a new report from Google Cloud released Wednesday.

The report details how IT operatives linked to the DPRK are infiltrating projects by posing as skilled remote developers. These individuals often build fake professional personas, using fabricated references and internal networks of false identities to land roles in high-trust environments. One operative reportedly managed a dozen fake identities simultaneously across Europe and the U.S.

Solana-based platforms—ranging from DeFi apps to developer job boards—are among the latest targets. The report highlights how these actors aren’t just pretending to be developers—they’re actively contributing, building platforms using Next.js, CosmosSDK, Rust, and even launching full Solana-powered marketplaces. One attacker even created an AI application integrated with blockchain technology using tools like Electron.

This marks a geographical shift from past attacks, which were primarily U.S.-focused. Increased legal pressure and DOJ indictments in the U.S. have pushed DPRK-linked entities to pursue European targets where security vetting and hiring processes may be looser.

Google also notes that bring-your-own-device (BYOD) policies present a soft entry point for these bad actors. “DPRK operatives have identified BYOD environments as a strategic vulnerability,” the report noted, warning that such setups are now being exploited in active operations.

The broader crypto space has already seen significant losses from North Korean hackers—over $1.3 billion in 2024 alone, with an additional $1.5 billion drained from Bybit in February 2025.

These trends suggest a troubling evolution in North Korea’s cyber strategy: blending advanced technical skill with social engineering to infiltrate and extract value from the global crypto economy.