Ethereum Foundation Grant Review Highlights Ketman

A recent Ethereum Foundation grant review turned an internal stipend recap into a concrete warning for Ethereum teams that hire across borders. The Foundation said Ketman was built to identify and remove DPRK IT workers using false identities inside blockchain organizations, putting sanctions exposure and insider risk in the same frame.

What the Grant Review Said About Ketman

In its April 16, 2026 ETH Rangers recap, the Ethereum Foundation said the program launched in late 2024, ran for six months, and covered work from 17 stipend recipients.

The same recap said a stipend recipient used the funding to build and scale Ketman, a project focused on discovering and expelling DPRK IT workers who infiltrated blockchain projects under fake identities.

During the stipend period, the Foundation said Ketman reached approximately 53 projects and identified around 100 DPRK IT workers operating inside Web3 organizations. Cointelegraph’s April 17, 2026 follow-up independently repeated the same figures, which matters because the social headline fragment that first pushed the story outward was incomplete.

The broader scorecard matters because the same ETH Rangers review said recipients collectively helped recover or freeze more than $5.8 million and reported or cataloged more than 785 vulnerabilities, client bugs, and proof of concepts. Read together, those metrics suggest the Foundation was treating ranger grants as measurable ecosystem defense work rather than soft community support.

Why the Ketman Mention Matters for Ethereum Watchers

Ketman’s about page says the project performs active threat hunting for DPRK IT workers and that the work was possible thanks to the Ethereum Foundation Grant Program. That linkage matters because it shows the Foundation was not just funding audits or bug discovery, but also underwriting counter-infiltration work aimed at human access points inside crypto teams.

Security Alliance’s DPRK mitigation guide, which the research brief says Ketman co-authored, states that organizations should immediately stop paying confirmed DPRK IT workers because such transfers are illegal. That makes the story more than a reputational problem: once a team has evidence that an operator is DPRK-linked, the compliance risk becomes immediate cash-flow risk.

That sanctions framing is consistent with the U.S. Treasury’s March 12, 2026 action, which said DPRK IT-worker fraud schemes generated nearly $800 million in 2024 and commonly relied on stolen identities and fabricated personas to gain employment. For Ethereum teams, the practical question is no longer whether fake applicants exist, but whether hiring, vendor review, and wallet permissioning are strong enough to catch them before payroll or code access is granted.

The operational angle also lands at a moment when crypto firms are already dealing with security spillovers elsewhere in the stack. Incidents like Kelp DAO rsETH Bridge Exploit Drains $292M as Aave Freezes Markets and the legal aftershocks in Circle Class Action Lawsuit Tied to Drift Protocol’s $280M Exploit show how quickly operational failures become treasury, liquidity, and liability problems.

That is also why the clipped social framing around Ketman should be treated cautiously. A post attributed to @_FORAB helped surface the grant recap, but because the snippet stopped before the project description was complete, the better standard is to rely on the Ethereum Foundation recap, the Ketman project page, and the Security Alliance framework instead of reconstructing missing words from a partial post.

Because the public recap gives output metrics, approximately 53 projects contacted and around 100 workers identified, but no project-level remediation data, the next disclosure Ethereum watchers should want is narrower: how many of those cases led to removals, whether any affected contributors had access to production systems, and what screening controls actually worked. That demand for operational detail sits alongside a market still debating capital structure and yield, from Strategy Proposes Semi-Monthly STRC Dividends Plan to other treasury-heavy narratives, even as sanctions-driven personnel risk keeps getting more concrete.

For now, the cleanest read is that the Ethereum Foundation used its ETH Rangers recap to spotlight a security investigation that sits between cyber defense and compliance enforcement. In a cycle where readers often focus on token price or product launches, Ketman’s inclusion signals that identity fraud inside developer teams is now material enough to appear in the same grant review as recovered funds and vulnerability reports.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.