United

Prime

Millions

DeFi

Security

<h2 id="how-the-recruitment-scam-works">How the Recruitment Scam Works</h2> North Korean hackers are deploying increasingly sophisticated <strong>fake job offers</strong> to infiltrate the cryptocurrency sector, according to new research and interviews with victims by Reuters. Known as “Contagious Interview,” the campaign uses LinkedIn and Telegram to impersonate recruiters from major crypto companies, tricking job seekers into downloading malicious code or sending video files that compromise their wallets.Targets reported being contacted by individuals posing as recruiters for <strong>Bitwise Asset Management</strong>, <strong>Ripple Labs</strong>, and <strong>Robinhood</strong>. After brief exchanges about positions, candidates were directed to obscure sites for “skills tests” or asked to record assessment videos using provided software. In several cases, digital wallets were drained soon after, with one victim losing $1,000 in ether and Solana. 
<p></p>
<h3 id="investor-takeaway">Investor Takeaway</h3>
<div style="background: #f9f9f9; border-left: 4px solid #ff9900; padding: 12px; margin: 16px 0;">
 The crypto industry is facing systemic social engineering attacks. Investors and employees should verify recruiter identities independently and avoid downloading unfamiliar software.
</div>
<h2 id="how-widespread-is-the-threat">How Widespread Is the Threat?</h2>
<p>The issue has become so common that applicants now screen recruiters for signs of North Korean involvement. Twenty-five industry experts and executives interviewed by Reuters described the scams as <strong>“ubiquitous.”</strong> Blockchain analytics firms <strong>SentinelOne</strong> and <strong>Validin</strong> are releasing a report attributing the campaign to Pyongyang, citing IP addresses and email accounts linked to past <a href="https://financefeeds.com/u-s-seeks-to-recover-2-67-million-from-north-korean-crypto-hacks/" rel="noopener noreferrer nofollow">North Korean hacking</a> operations.</p>
<p>Accidentally exposed log files showed more than <strong>230 people targeted</strong> between January and March alone, ranging from coders and accountants to consultants and executives. Nineteen confirmed to Reuters that they had been approached. “It happens to me all the time and I’m sure it happens to everybody in this space,” said Carlos Yanez of Global Ledger, who avoided compromise but described the scams as increasingly convincing.</p>
<h2 id="why-crypto-remains-a-prime-target">Why Crypto Remains a Prime Target</h2>
<p>North Korean hackers were estimated to have stolen at least <strong>$1.34 billion in cryptocurrency</strong> last year, according to Chainalysis. The U.S. and United Nations say the regime channels proceeds into its sanctioned weapons program. While theft from exchanges and DeFi exploits have long been documented, the job-offer campaign represents a more personalized form of social engineering that directly targets employees and job seekers.</p>
<p>The FBI has previously warned that <a href="https://financefeeds.com/bitmex-targeted-in-linkedin-scam-tied-to-north-koreas-lazarus-group/" rel="noopener noreferrer nofollow">North Korea was “aggressively” targeting</a> the sector with elaborate social engineering schemes. Companies including Robinhood, Ripple, and Bitwise either declined to comment or confirmed steps to disable fake domains. LinkedIn and Telegram said they had acted against fraudulent accounts identified by Reuters, though acknowledged the difficulty of policing impersonation attempts at scale.</p>
<h3 id="investor-takeaway">Investor Takeaway</h3>
<div style="background: #f9f9f9; border-left: 4px solid #ff9900; padding: 12px; margin: 16px 0;">
 With billions stolen annually, North Korea’s cyber operations are among the largest state-backed threats to crypto markets. Enhanced due diligence is essential for firms hiring in the space.
</div>
<h2 id="what-s-next-for-the-industry">What’s Next for the Industry?</h2>
<p>Security experts warn that the fake recruiter scam is only one facet of North Korea’s broader push to infiltrate and exploit <a href="https://financefeeds.com/bitcoin-garnered-87-of-total-flows-into-digital-asset-market-in-2023/" rel="noopener noreferrer nofollow">digital asset markets</a>. Aleksandar Milenkoski of SentinelOne said the <a href="https://financefeeds.com/china-extradites-mbi-group-scam-operative-from-thailand/" rel="noopener noreferrer nofollow">group behaves like a “typical scam</a> operation” that prioritizes scale, seeking as many potential victims as possible. Kraken’s <a href="https://financefeeds.com/apex-group-appoints-azeem-bashir-as-group-chief-information-security-officer/" rel="noopener noreferrer nofollow">chief security officer</a> Nick Percoco confirmed the firm saw a surge in recruitment scams late last year, with reports persisting into spring 2025.</p>
<p>For now, crypto companies are deploying monitoring tools to detect fake recruiter profiles and relying on user reports to shut them down. But as long as the sector remains a major source of hard currency for Pyongyang, industry insiders expect the campaigns to continue. The arrests of fake recruiters or the takedown of websites may slow operations, but the scale of targeting suggests crypto workers will remain on the front line of state-backed cybercrime.</p>

North Korean Hackers Lure Crypto Workers With Fake Job Offers, Steal Millions

Table of Contents

FinanceFeeds

Other articles published on Sep 5, 2025

Join our free newsletter for daily crypto updates!