Coinbase Tightens Security to Counter DPRK Hacker Threats

Coinbase CEO Brian Armstrong revealed in an interview with Stripe’s John Collison on August 20, 2025, the extent to which North Korean hackers attempt to infiltrate cryptocurrency platforms. According to Armstrong, agents from the DPRK are being trained in specialized schools and sent to work remotely as IT professionals in Western companies. These agents, often operating under fake identities, aim to exploit vulnerabilities in tech firms to steal valuable data and cryptocurrency [1].

The tactics used by DPRK hackers include attempting to bribe Coinbase support team members with hundreds of thousands of dollars in exchange for confidential information, such as internal access or screenshots of sensitive data [2]. In response, Coinbase has taken decisive actions to enhance its internal security protocols. Employees with access to sensitive systems must be U.S. citizens with family residing in the U.S., and they are fingerprinted for identity verification. Additionally, all new hires undergo in-person orientation in the United States to ensure no external influence or coercion is present during the hiring process [3].

Armstrong emphasized that while companies collaborate with law enforcement to flag known threat actors, the DPRK continues to produce hundreds of new agents every quarter, making infiltration a persistent risk. During online interviews, Coinbase now requires candidates to enable their cameras to prevent third-party coaching from the DPRK. The company has also implemented a zero-tolerance policy for employees who accept bribes, with Armstrong stating that those caught are prosecuted to the fullest extent of the law, even if they believe the financial incentive is life-changing [4].

Coinbase is also offering a $20 million bounty for information leading to the arrest or conviction of DPRK hackers. The company is not limiting its efforts to internal investigations but is actively targeting the external actors themselves, signaling a broader strategy to disrupt North Korea’s cybercrime activities. This approach aligns with the broader recognition that stolen cryptocurrency has historically funded North Korea’s nuclear program. As reported by blockchain analytics firm Elliptic, the DPRK has stolen over $5 billion in cryptocurrency since 2017, with a significant portion believed to support its military objectives [5].

North Korean hackers have used various methods to steal and launder stolen cryptocurrency, including fake LinkedIn and Upwork profiles, compromised Google accounts, and job platform serial numbers. Despite their limited technical competence, these agents persist in their efforts and often operate in clusters, increasing their chances of success. An anonymous crypto sleuth, known as ZachXBT, revealed that DPRK agents were using over-the-counter brokers and crypto mixers like Sinbad and Tornado Cash to obscure the trail of stolen assets [6].

Coinbase’s security measures come amid a broader industry-wide concern over the role of exchanges in facilitating North Korea’s illicit activities. Critics, including ZachXBT, have accused some companies of negligence in addressing DPRK-related transactions. For example, public company Circle was criticized for not freezing USDC addresses linked to DPRK agents, despite prior warnings. The company eventually took action months later after further investigation [7].

Given Coinbase’s responsibility for over 2.2 million bitcoins—representing more than 10% of the total supply—the company’s heightened security protocols are seen as both a necessary and prudent response to a growing threat. Armstrong’s comments highlight the ongoing battle between cryptocurrency firms and state-sponsored cyber actors, emphasizing the importance of robust internal controls and external cooperation in mitigating risks from North Korean cyber threats.

Source: [1]https://coinmarketcap.com/community/articles/68a9a17c302c96076a1a012f/