North Korean agent in crypto job fraud at octopuses

In a cyber security application that sounds more like spy fiction than reality, Kraken recently thwarted an attempted infiltration of a North Korean hacker who had disguised himself as a job seeker.

Was than more ordinary Application process started quickly, caused a sensation when an applicant gave contradictory information on his identity and was apparently conducted in real time through the interview, whereby he changed his voice in the middle of the conversation. Behind the scenes, the Kraken security team reported this behavior and began with discrete investigations.

The situation escalated when one of the applicants' emails agreed with a list that was exchanged among crypto companies-addresses that were suspected of being associated with sanctioned North Korean actors. A more detailed examination covered a widely branched network of fake identities that were used for applications in the entire industry and of which some had already avoided the company's security measures.

Instead of rejecting the applicant immediately, Kraken let him go through several interviews in order to consciously gain time and collect information. The trap was made with the Chief Security Officer of the stock exchange during a last phone call. A number of live questions for checking-from local geography to identity confirmation-embarrassed the applicant and finally revealed the deception.

Kraken's report emphasized that cyber security threats now extend far beyond traditional attack areas. In a time of AI generated personas and social engineering, even the inbox of the HR department has become a potential point of attack.

As Kraken later confirmed, the person concerned was related to more comprehensive North Korean operations, which were estimated to have deducted over $ 650 million from crypto platforms in 2024 alone.

The company concluded with an urgent reminder: not all attacks are done via code. Sometimes they start with a résumé.