The 2025 Favrr heist
In a twist worthy of a cyber‑thriller, a group posing as blockchain developers pulled off a $680,000 heist on fan token marketplace Favrr in June 2025, only to be unmasked when one of their own devices was counter‑hacked.
What emerged was startling: Six North Korean operatives had at least 31 fake identities. They carried forged government IDs, phone numbers and fabricated LinkedIn and Upwork profiles. Some even posed as talent from Polygon Labs, OpenSea and Chainlink to infiltrate the crypto industry.
The digital breadcrumbs (screenshots, Google Drive exports, Chrome profiles) revealed just how meticulously they orchestrated the infiltration.
Crypto investigator ZachXBT traced their activity onchain, connecting one wallet address to the Favrr exploit and confirming this was not just a phishing scheme but a coordinated developer‑level infiltration.
Did you know? North Korea-linked hackers stole about $1.34 billion in crypto in 2024, accounting for 60% of global thefts. The attacks spanned 47 incidents, double the number from the previous year.
How the hack was discovered
The Favrr breach came to light through a twist of cyber fate — one of the alleged North Korean operators was counter-hacked.
An unnamed source gained access to one of their devices, unveiling a trove of internal artifacts: screenshots, Google Drive exports and Chrome profiles that mapped out how the hackers coordinated their scheme
These files painted a startling picture: six operatives running at least 31 fake identities.
Their operational playbook was revealed in detail, from spreadsheets that tracked expenses and deadlines to Google Translate facilitating their English-language deception, right down to rented computers, VPNs and AnyDesk for stealthy access.
Crypto sleuth ZachXBT then traced the stolen funds onchain, uncovering a wallet address “closely tied” to the $680,000 Favrr exploit in June 2025.
Together, these revelations confirm this was a deeply coordinated…
..
