North Korean hackers are intensifying their efforts to breach cryptocurrency firms by impersonating IT professionals, raising growing security concerns across the blockchain industry. Binance co-founder Changpeng โCZโ Zhao highlighted the threat in a recent statement, emphasizing that these actors are increasingly utilizing employment scams and bribery to gain access to sensitive data and internal systems.
Zhao warned that these malicious agents often pose as job candidates, targeting development, security, and financial positions to gain a foothold within crypto companies. โThey pose as employers and try to interview or offer jobs to your staff. During these fake interviews, they may send malicious links or viruses via Zoom, which can compromise employee devices,โ Zhao explained. Other tactics involve agents sending malicious coding samples or phishing links to customer support teams, as well as bribing employees and contractors for data access.
He urged cryptocurrency platforms to prioritize employee training on cybersecurity best practices, particularly on avoiding the download of suspicious files and verifying candidate identities thoroughly.
The warning comes amid ongoing concerns about North Korean cyber activity, with Coinbase indicating a similar rise in threats last month. Coinbase CEO Brian Armstrong responded by tightening internal security measures, including mandatory in-person training for US-based staff and enhanced vetting procedures for employees with access to sensitive data, such as fingerprinting and US citizenship requirements.
In parallel, a cybersecurity collective known as Security Alliance (SEAL) has identified at least 60 North Korean operatives posing as IT workers. This group has compiled detailed profiles, including aliases, fake identities, email addresses, and the locations of these impersonators, many of whom are actively seeking employment or conducting espionage against U.S.-based crypto exchanges.
Recent incidents highlight the danger: in June, four North Korean hackers infiltrated multiple crypto startups as freelance developers, stealing approximately $900,000. To counter these threats, the white hat SEAL team, led by Paradigm researcher Samczsun, has conducted over 900 investigations in the past year, illustrating the urgent need for specialized cybersecurity efforts in the crypto sector.
From the notorious Lazarus Group to various other state-sponsored teams, North Korean hackers are responsible for some of the most significant thefts in digital asset history. Reported cyber heists amount to over $1.34 billion stolen in 2024 alone, more than doubling the previous year’s losses, according to Chainalysis data.
As the industry combats this rising tide of cyber threats, strengthening security protocols remains vital for safeguarding the integrity of the global crypto markets and the growing world of decentralized finance (DeFi) and NFTs.
