Kraken Uncovers North Korean Hacker’s Infiltration Attempt Through Job Application
In a stark reminder of how cyber threats can spread beyond traditional channels, cryptocurrency exchange Kraken recently announced that it had uncovered and thwarted an infiltration attempt by a North Korean hacker who was applying for a job.
The attacker applied for an engineering position at Kraken and, through a series of suspicious behaviors, led the company’s security and IT teams to identify him as part of a state-backed operation. The incident highlights a new front emerging in the cybersecurity war: the hiring process.
“Verify, don’t trust,” said Nick Percoco, Kraken’s Director of Security. “State-backed attacks are not just a problem with cryptocurrencies; they are a global threat. Resilience starts with being prepared at every level.”
Red flags emerged early on. The candidate showed up for the first video interview under a different name than the one listed on his resume, and changed his name during the interview. Kraken’s recruiters also noticed voice changes, suggesting the applicant was receiving coaching in real time.
Further investigation revealed that the email address used by the applicant had been flagged by industry partners as being linked to a North Korean hacker network, which dovetailed with broader warnings in the crypto community that state-backed actors were targeting job applicants at crypto companies.
Using Open Source Intelligence (OSINT) methods, Kraken’s team uncovered that the email was part of a network of fake identities, many of which had jobs at other companies, including one with ties to a sanctioned foreign agent.
Rather than reject the candidate outright, the Kraken team chose to continue the recruitment process as a controlled intelligence operation to learn more about the tactics used.
The candidate failed miserably because he could not answer questions about the position convincingly and could not verify his identity.
This is not investment advice.