Exposed: How North Korea’s Crypto Hiring Scams Infiltrate Blockchain Companies
Pyongyang's latest hustle? Fake job offers targeting decentralized finance teams.
### The Lazarus recruitment playbook
Phantom interviews, forged references, and GitHub repos stuffed with stolen code—North Korean operatives are weaponizing crypto's talent crunch. No need for malware when HR is the attack vector.
### OPSEC fails that make compliance officers weep
From 'remote developers' demanding hardware shipments to Eastern Europe to 'project managers' insisting on Telegram-only comms—the red flags wave themselves. Yet VC-funded startups keep taking the bait.
### When 'bull market due diligence' meets geopolitics
Three-letter agencies are tracking stolen funds through mixers, while crypto CTOs still argue 'the code speaks for itself.' Meanwhile in Pyongyang: another yacht bought with your seed round.
Remember—in crypto, if the 'candidate' knows more about evading OFAC than Solidity, maybe do a background check. Just this once.
A growing concern
Cheqd isn’t alone. North Koreans have attempted—in some cases successfully—to infiltrate multiple crypto companies over the last few years. Earlier this year, crypto exchange Kraken revealed they had been targeted, although the person was caught before a hire was made.
Recruiter Owen Healey, director of Ireland-based Owen Healey Blockchain Talent, told Decrypt that using predominantly European candidates in the early stages of interviews is a tactic he has only begun to see emerging over the past few months.
He’s no stranger to dealing with North Koreans trying to secure jobs in crypto; he’s been approached by them numerous times over the past few years and has published extensive advice on LinkedIn on how to identify and weed them out of the recruiting process.
“There are simple hacks,” he said. Among them, he said he tries to engage them in conversations about popular culture or the place where they claim to be living—he notes that a disproportionate number claim to be based in Toronto, Canada.
“The goal, I suppose, is just getting them off-script, and then it becomes pretty obvious that they're not who they say they are,” he said.
But this new pattern could make that less effective. “That seems to be the next thing that they're targeting, getting proxies in legitimate countries to represent them and then ultimately that work being outsourced to North Korea.”
He raised concerns about how this could affect companies’ attitudes to remote hiring, and particularly hiring from abroad, and misidentifying genuine applicants as North Korean workers simply because they are based in Asia.
Recruitment in the age of AI
It comes as technology is making considerable changes in hiring and recruitment.
One non-crypto recruiter Decrypt spoke to bemoaned increased use of AI leading to a deluge of “AI slop” in the FORM of unedited AI-generated CVs and cover letters peppered with ChatGPT stock phrases.
They said their company had seen claims for skills candidates didn’t possess, misrepresentations about language skills, and a general increase in workload as they needed to introduce more stringent verification processes to test the claims of potential hires.
While in some areas this simply meant qualification checks, trying to prove more specific skills, such as coding or language skills—which require the person doing the hiring to also possess them—are proving difficult.
Even attempts to test skills are becoming a cat-and-mouse game with the advent of new technology.
Where Cheqd has been implementing live programming tests to ensure developers possess the skills they claim and aren’t using AI to assist them, in the U.S., a former Columbia University student recently raised $5.3 million for his startup, Cluely, to help people cheat in job interviews, exams, and sales calls.
A promo video by the company shows the founder, Chungin Lee, using the tech to fake interests and get advice while on a date.
Such tools will undoubtedly help North Korean IT workers bypass “pop culture tests” and other measures companies are trying to employ to identify them, as will the hiring of non-North Koreans to assist them in securing jobs.
As for Cheqd, it’s now trying to work out how to shore up its recruitment processes. It’s about to hire for a few new roles, and Edwards thinks the process is likely to be more difficult when it comes to identifying fraud and scam attempts than it was previously.
His first port of call has been to rely more on his already existing networks and seek recommendations from people he already knows.
“We may not even go out to market, which is terrible because if you don't have that network you are kind of screwed [when it comes to finding a job]” he said.
