On-chain research identified more than $16.58 million in payments since January 2025 to alleged North Korean IT workers hired as developers across crypto projects and other companies. One monitored cluster tied eight DPRK IT workers to more than 12 roles, with payments consolidating through shared addresses and red flags including Russian IP use, failed KYC, deleted or renamed profiles, and workers referring one another into the same teams. The excerpt lists consolidation addresses, notes USDC flows from Circle accounts, and says some funds were one hop from an address tied to Hyon Sop Sim that Tether blacklisted in April 2023. The activity matters because DPRK IT worker placement can give workers access to contracts, code, and payment rails, increasing both sanctions-evasion and insider-risk exposure for startups and traditional technology companies.