hgjgf

 Inside North Korea's Hiring Scams Targeting Crypto Firms

Companies and recruiters are warning that North Korea is hiring Europeans as fronts for job interviews, and the problem is only getting worse.

In brief

• Individuals Decrypt spoke to said they had seen tactics by North Korean IT workers to get hired by foreign companies change over the past few months.
• They believe the country is hiring foreigners to help them get through early rounds of interviews.
• North Korea stole $1.34 billion in crypto last year.

The software developer who turned up on the call for an interview with UK verification startup Cheqd a few months ago ticked all the right boxes. Based somewhere in Europe, he knew his stuff, had some experience, and spoke good English.

However, when they returned for the second round of the interview process and a live programming test, their accent had become distinctly more Asian, their internet connection was lagging, and their camera wouldn’t switch on. 

More concerningly, when the team at Cheqd reviewed a recording of their screen during the coding test, they found footage of them switching between tabs and pages with Korean characters.

Fraser Edwards, CEO and founder of Cheqd, told Decrypt that this individual was just one of around five attempts by suspected North Korean operators to join the company that his team had seen over the last year. And while attempts by North Korea to infiltrate tech and crypto companies in order to hack them have been ongoing for several years, companies and recruiters are now reporting that the country may be hiring foreigners to pose as fronts to help get them through the early stages of the recruitment process.

“Almost universally, you'd go from someone who would sound European on the first call to someone who would very much sound like they were from somewhere in Asia,” Edwards said.

More than $2.2 billion was stolen from crypto platforms by hackers in 2024, according to Chainalysis, representing a 21% increase over the previous year. Of that 61%, or $1.34 billion, of funds stolen has been attributed to North Korean state actors. 

“It appears that the DPRK’s crypto attacks are becoming more frequent,” the company noted in its annual report. 

“Some of these events appear to be linked to North Korean IT workers, who have been increasingly infiltrating crypto and Web3 companies, and compromising their networks, operations, and integrity.

Those workers often use sophisticated Tactics, Techniques, and Procedures, such as false identities, third-party hiring intermediaries, and manipulating remote work opportunities to gain access.”

A growing concern

Cheqd isn’t alone. North Koreans have attempted—in some cases successfully—to infiltrate multiple crypto companies over the last few years. Earlier this year, crypto exchange Kraken revealed they had been targeted, although the person was caught before a hire was made. 

Recruiter Owen Healy, director of Ireland-based Owen Healy Blockchain Talent, told Decrypt that using predominantly European candidates in the early stages of interviews is a tactic he has only begun to see emerging over the past few months.