Kraken Details How it Spotted North Korean Hacker in Job Interview

In a shocking revelation, the US-based cryptocurrency exchange Kraken has revealed how it identified and thwarted an attempted infiltration by a North Korean hacker during a job interview process. The incident serves as a stark reminder of the increasing sophistication and threat posed by state-sponsored cyberattacks.

According to Kraken's blog post published on May 1, the alleged North Korean hacker applied for an engineering role at the company under a pseudonym, raising red flags from the start. As the interview progressed, the applicant's voice would occasionally switch between different tones, indicating that they were being guided through the process.

Rather than immediately rejecting the candidate, Kraken decided to advance them through its hiring process in an effort to gather more information about their tactics and methods. However, as the company delved deeper, it became clear that something was amiss. Industry partners had tipped off Kraken about North Korean actors applying for jobs at crypto companies, including the exchange.

With this intelligence, Kraken's security team uncovered a network of fake identities used by the hacker to apply to multiple companies, including Kraken. Technical inconsistencies were also detected, such as the use of remote Mac desktops through VPNs and altered identification documents.

The applicant's resume was linked to a GitHub profile containing an email address exposed in a past data breach, further raising suspicions. During final interviews, Kraken's chief security officer Nick Percoco conducted trap identity verification tests that the candidate failed, confirming the deception.

"Don't trust, verify," said Peroco. "This core crypto principle is more relevant than ever in the digital age." He emphasized that state-sponsored attacks are no longer just a US corporate issue but a global threat.

The Rise of North Korean-Linked Hackers

North Korea's attempts to infiltrate and exploit the cryptocurrency market have been on the rise, with the country-linked Lazarus Group responsible for several high-profile hacks in recent years. In February, the group was involved in a $1.4 billion Bybit exchange hack, the largest ever in the crypto industry.

In 2024 alone, North Korean-linked hackers stole over $650 million through multiple crypto heists and deployed IT workers to infiltrate blockchain and crypto companies as insider threats. A recent US-Japan-South Korea statement highlighted the scope of this threat, with a subgroup of Lazarus setting up three shell companies in the US to deliver malware to unsuspecting users and scam crypto developers.

The incident highlights the growing importance of robust cybersecurity measures in the cryptocurrency sector, particularly for companies operating globally. As state-sponsored attacks become increasingly sophisticated, it is essential for businesses and individuals alike to remain vigilant and verify information before trusting anyone or anything.

A Call to Action

"The cyber landscape has changed, and we need to adapt," said Peroco. "We must prioritize security awareness and implement robust measures to prevent these types of attacks." As the cryptocurrency market continues to evolve, it is crucial that companies like Kraken lead the way in setting a high standard for cybersecurity.