Kraken details how it spotted North Korean hacker in job interview

US crypto exchange Kraken has detailed a North Korean hackers attempt to infiltrate the organization by applying for a job interview.What started as a routine hiring process for an engineering role quickly turned into an intelligence-gathering operation, the company wrote in a May 1 blog post.Kraken said the applicants red flags appeared early on in the process when they joined an interview under a name different from what they applied with and occasionally switched between voices, apparently being guided through the interview.Rather than immediately rejecting the applicant, Kraken decided to advance them through its hiring process to gather information about the tactics used.International sanctions have effectively cut North Korea off from the rest of the world, and the countrys ruling Kim family dictatorship has long targeted crypto companies and users to top up the countrys coffers. Its stolen billions worth of crypto so far this year.Kraken reported that industry partners had tipped them off that North Korean actors were actively applying for jobs at crypto companies.We received a list of email addresses linked to the hacker group, and one of them matched the email the candidate used to apply to Kraken, it said.With this information, the firms security team uncovered a network of fake identities used by the hacker to apply to multiple companies.Kraken also noted technical inconsistencies, which included the use of remote Mac desktops through VPNs and altered identification documents.Kraken CSO @c7five recently spoke to @CBSNews about how a North Korean operative unsuccessfully attempted to get a job at Kraken. Dont trust. Verify 👇 pic.twitter.com/1vVo3perH2 Kraken Exchange (@krakenfx) May 1, 2025src="https://platform.twitter.com/widgets.js" charset="utf-8">The applicants resume was linked to a GitHub profile containing an email address exposed in a past data breach, and the exchange said the candidates primary form of ID appeared to be altered, likely using details stolen in an identity theft case two years prior.During final interviews, Kraken chief security officer Nick Percoco conducted trap identity verification tests that the candidate failed, confirming the deception.Related: Lazarus Groups 2024 pause was repositioning for $1.4B Bybit hackDont trust, verify. This core crypto principle is more relevant than ever in the digital age, Peroco said. State-sponsored attacks arent just a crypto or US corporate issue theyre a global threat.North Korea pulls off biggest-ever crypto hackNorth Korea-affiliated hacking collective Lazarus Group was responsible for Februarys $1.4 billion Bybit exchange hack, the largest ever for the crypto industry.North Korean-linked hackers also stole more than $650 million through multiple crypto heists during 2024, while deploying IT workers to infiltrate blockchain and crypto companies as insider threats, according to a statement released by the US, Japan and South Korea in January.In April, a subgroup of Lazarus was found to have set up three shell companies, with two in the US, to deliver malware to unsuspecting users and scam crypto developers.Magazine: Japanese porn stars coin red flags, Alibaba-linked L2 runs at 100K TPS: Asia Express