Coinbase tightens hiring after North Korean cyber infiltration attempts

Coinbase has significantly revised its hiring protocols in response to repeated attempts by North Korean hackers to infiltrate its systems through job applicants. The cryptocurrency exchange has moved away from a fully remote onboarding model, now requiring all new hires to complete in-person orientations within the U.S. Additionally, individuals with access to sensitive infrastructure must be U.S. citizens and undergo fingerprint verification [3]. These changes aim to counter tactics such as deepfake interviews, fake identities, and bribery, which have been reported to be used by North Korean operatives to gain insider access to crypto firms [3].

The company’s CEO, Brian Armstrong, highlighted the scale of the threat on the Cheeky Pint podcast, describing how North Korean IT workers seem to be “graduating from some school every quarter” with the sole purpose of infiltrating U.S. technology companies. To mitigate this, Coinbase now requires all interviewees to keep their cameras on during calls. This measure is intended to detect coaching, AI-assisted impersonation, or deepfake participation during the hiring process [3]. Armstrong emphasized that the risks associated with infiltration are severe, noting that attackers have offered hundreds of thousands of dollars to support staff to photograph sensitive internal information [3].

Coinbase’s enhanced hiring standards are part of a broader industry trend responding to heightened cybersecurity threats. North Korean hacking groups, including the state-sponsored Lazarus, have a documented history of targeting financial institutions and crypto exchanges. These groups have been linked to major cyberattacks, such as the 2018 Bangladesh Bank heist, where over $534 million was stolen [3]. The use of job application processes as an entry point for infiltration has raised particular concern, especially in the crypto sector, which operates with a global workforce and digital infrastructure [3].

In July, the FBI confirmed that North Korean operatives were posing as freelance developers to infiltrate U.S. companies. These actors worked alongside both knowing and unknowing Americans, using fake businesses, company equipment, and even conducting interviews on behalf of others [3]. In one notable case, a U.S. woman was sentenced to 8.5 years in prison for assisting North Korean nationals in securing tech jobs under false identities. Such incidents underscore the urgency of tightening hiring procedures [3].

While Coinbase’s approach aims to strengthen internal security, some analysts have cautioned against overly rigid hiring protocols that could hinder recruitment or alienate qualified candidates. ZachXBT, an on-chain investigator, has argued that North Korean hackers are often less sophisticated than portrayed, and that simple measures—such as unusual video call requirements—can disrupt their attempts [3]. He advocates for a more balanced approach that focuses on HR education and awareness rather than excessive verification steps.

Coinbase’s shift in hiring strategy reflects a broader trend in the crypto industry, where recruitment is increasingly viewed as a critical component of cybersecurity. The challenge lies in balancing the need for security with the need to attract and retain top talent. As the threat landscape evolves, companies must adapt their hiring practices to mitigate risks without compromising operational efficiency [3].

Source: [3] ZachXBT Challenges the Myth of North Korean Hackers' 'Genius' (https://forklog.com/en/zachxbt-challenges-the-myth-of-north-korean-hackers-genius/)