North Korean hackers created three companies — two of which were US-based — to distribute malware to cryptocurrency developers.