Coinbase Forces U.S. Citizenship to Guard Against North Korean Cyber Threats

Coinbase, the world’s third-largest cryptocurrency exchange by trading volume, has implemented a new U.S. citizenship requirement for employees with access to sensitive systems as part of its broader security overhaul. The policy change follows escalating concerns over North Korean cyber threats, with CEO Brian Armstrong disclosing in a recent podcast interview that North Korean IT workers are exploiting the company’s remote work policies to infiltrate its systems. Armstrong emphasized that these individuals are often coerced by the regime or incentivized through bribes to compromise internal data. In response, Coinbase now mandates in-person onboarding for all employees and requires individuals with access to critical systems to be U.S. citizens who undergo fingerprinting [1].

The company’s decision reflects a growing trend in the cybersecurity landscape, where remote work models are being re-evaluated in light of geopolitical risks. Armstrong noted that North Korea has been aggressively training thousands of IT workers annually to target U.S. companies, with some working through intermediaries to bypass identity checks. As part of its mitigation strategy, Coinbase also enforces strict verification protocols during interviews, including requiring candidates to turn on their video feeds to confirm they are not using AI or being coached [2]. The measures are intended to prevent scenarios where North Korean operatives, either through coercion or financial incentives, gain access to internal systems and sensitive data.

Coinbase’s efforts are not limited to the hiring process. The company has also taken steps to limit the amount of sensitive information accessible to customer support agents. Armstrong stated that employees who attempt to violate security protocols face severe consequences, including prosecution and potential imprisonment. This comes after Coinbase confirmed a data breach earlier this year in which customer support staff were allegedly bribed to photograph sensitive information [3]. The firm has since relocated some operations to the U.S. and Europe, reinforcing internal security by using locked-down devices and limiting employee access to critical data.

The shift in Coinbase’s approach underscores the broader challenges faced by companies in the cryptocurrency sector. North Korea has long targeted crypto firms due to their potential to move large amounts of digital assets with relative anonymity. The regime has been linked to a number of high-profile cyberattacks, including a reported $1.4 billion theft from the Bybit exchange. Armstrong’s remarks highlight the need for companies to adapt to an increasingly hostile threat landscape, where cybercrime is not just a technical issue but a geopolitical one.

Industry analysts suggest that Coinbase’s strategy may influence other firms operating in the digital asset space. As North Korean cyber operations become more sophisticated, companies are likely to adopt stricter verification and access control measures. The balance between maintaining a remote-first workforce and ensuring robust security remains a key challenge, particularly in an era where deepfakes and AI-based deception are growing concerns. Coinbase’s approach reflects a proactive stance in safeguarding its systems and data, aligning with broader industry efforts to mitigate the risks posed by state-sponsored cyber threats.

Source: [1] Coinbase Mandates in-Person Orientation to Stop North ... (https://www.businessinsider.com/coinbase-north-korea-threats-remote-work-2025-8) [2] To Avoid Hiring North Koreans, Coinbase Now Requires In ... (https://www.pcmag.com/news/to-avoid-hiring-north-koreans-coinbase-now-requires-in-person-orientations) [3] Coinbase Tightens Workforce Security After North Korea ... (https://cointelegraph.com/news/coinbase-tightens-workforce-security-after-north-korea-remote-worker-threats)