Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. They also reported a SynthID watermark, the invisible marker Google embeds in images its AI tools create or edit. The July 31 joint alert says North Korean IT workers seek contracts with the intent of remitting their salaries to parent North Korean agencies. Silent Push has separately tracked Astrill as a fixture of North Korean operations. The report presents the Gemini-processing metadata and the SynthID watermark as separate findings but does not explain how the watermark itself was detected.