According to CoinMeta, as reported by Cointelegraph, BCA Ltd founder Mauro Eldritch and Telef along with nica and Tech analyst Heiner Garc established a fake crypto startup Ballena Azul to lure suspected North Korean IT workers to work in a controlled environment for five weeks while monitoring their behavior. The investigation found that the servers used by these workers were linked to North Korean infrastructure that distributed malware such as InvisibleFerret, Beavertail, and OtterCookie. Moreover, the workers used ChatGPT and Google Gemini to forge identities. North Korean IT workers obtained remote jobs by forging American identities, and the wages earned were directed towards Pyongyang's weapons of mass destruction programs. Data from the U.S. Treasury Department shows that such schemes generated nearly $800 million for North Korea in 2024.