Cryptocurrency exchange Kraken recently uncovered a sophisticated infiltration attempt by a North Korean hacker who applied for an engineering position at the company.
Instead of immediately rejecting the suspicious application, Kraken’s security team strategically advanced the candidate through multiple interview stages, gathering critical intelligence about state-sponsored hacking techniques in the process.
On May 1, 2025, Kraken disclosed that what began as a routine hiring process quickly transformed into a counterintelligence operation when security teams identified suspicious patterns in a job application.
North Korean Cyber Infiltration
Industry partners had previously warned crypto companies about North Korean hackers applying for positions, providing a list of email addresses linked to the hacker group-one of which matched the candidate’s application email.
“From the outset, something felt off about this candidate. During their initial call with our recruiter, they joined under a different name from the one on their resume, and quickly changed it,” said Nick Percoco, Kraken’s Chief Security Officer.
“Even more suspicious, the candidate occasionally switched between voices, indicating they were being coached through the interview in real time”.
Kraken’s security team investigated the suspicious applicant using Open-Source Intelligence (OSINT) gathering methods. Their analysis revealed numerous technical inconsistencies that pointed to a state-sponsored infiltration attempt.
The investigation uncovered that the candidate used remote colocated Mac desktops accessed through a VPN-a setup commonly used to mask location and network activity.
Their resume was linked to a GitHub profile containing an email address exposed in a past data breach, and their primary identification appeared altered, likely using details stolen in an identity theft case.
Kraken’s Counter-Operation
Rather than immediately rejecting the application, Kraken’s security and recruitment teams advanced the candidate through their rigorous recruitment process to study their approach.
The final interview included subtle verification challenges, such as asking the candidate to recommend local restaurants in their claimed city of residence-a test the hacker failed, becoming flustered and unable to provide convincing answers.
This infiltration attempt highlights the escalating threat from North Korean state-sponsored hackers targeting the cryptocurrency sector.
The notorious Lazarus Group has been linked to crypto heists totaling over $650 million in 2024 alone. Their tactics include deploying malware like TraderTraitor and creating fake identities to apply for positions at cryptocurrency firms.
Earlier this year, the Lazarus Group was implicated in the record-breaking $1.5 billion theft from cryptocurrency exchange ByBit, with hackers already laundering approximately $300 million of those stolen funds.
“Don’t trust, verify. This core crypto principle is more relevant than ever,” Percoco advised.
“State-sponsored attacks aren’t just a crypto issue-they’re a global threat. Resilience starts with operationally preparing to withstand these types of attacks”.
This case serves as a warning to companies across industries: sometimes the biggest security threats don’t attempt to breach your systems from the outside-they try to walk through the front door with a resume in hand.
