Maryland recently handed down a pretty outrageous verdict. A local named Minh Phuong Ngoc Vong got 15 months in prison plus three years of supervised release because he helped programmers from a certain East Asian country use fake identities to infiltrate the US tech industry.

This guy’s operation was textbook-level identity swapping: from 2021 to last year, he helped at least 13 companies “hire” software engineers—the quotation marks are because the people on the resumes didn’t actually exist. The real work was being done by foreign hackers thousands of miles away. What’s even crazier is that some of these positions had access to high-level system permissions like those at the Federal Aviation Administration (FAA).

This incident is a wake-up call for the remote work era. These days, lots of Web3 projects recruit globally, and after just one video interview, someone might get backend wallet access. The tech world really needs to rethink KYC—not just for users, but maybe even more so for those doing the work. After all, code permissions are way more dangerous than transfer permissions; a single line of backdoor code could drain an entire protocol.