North Korea's Shadow War: How Fake Job Candidates Are Stealing Crypto Billion

CZ, the founder of Binance, has issued an urgent warning about a sophisticated cyber threat originating from North Korea, wherein hackers are infiltrating cryptocurrency firms by posing as job candidates. The threat is part of a broader campaign that has already resulted in the theft of $1.3 billion in 2024 and over $2.2 billion in the first half of 2025. The hackers utilize elaborate schemes such as fake job applications, fraudulent interviews, and the bribery of employees to gain access to critical systems within these companies. According to CZ, these individuals often target roles in developer, security, and finance departments, using these positions as a “foot in the door”.

The methods employed by these hackers have evolved significantly. One such example is the creation of fake U.S. corporations, such as Blocknovas LLC and Softglide LLC, which serve as fronts for cyber attacks. These entities were registered under legitimate-sounding names, sometimes even in real locations, to appear credible. For instance, Blocknovas LLC was linked to a vacant lot in South Carolina, while Softglide LLC was associated with a small tax office in Buffalo. These operations are believed to be part of a broader strategy by North Korean operatives to infiltrate the global cryptocurrency infrastructure.

An advanced Python-based malware called PylangGhost has also emerged as a major threat. This malware, linked to the North Korea-affiliated group “Famous Chollima,” is distributed through fake job interview websites impersonating companies like Coinbase and Robinhood. Cisco Talos has documented how these sites use social engineering tactics to trick victims into downloading malicious payloads under the pretense of installing video drivers. Once installed, PylangGhost grants attackers remote access to systems and the ability to harvest credentials from over 80 browser extensions, including MetaMask, Phantom, and NordPass. The malware is particularly concerning for its sophisticated capabilities, such as remote file access and OS shell control.

The scope of the attacks extends beyond malware deployment. North Korean operatives are also employing complex laundering tactics and purchasing stolen American identities to obscure the origins of the funds. These tactics include the use of fake accounts, transaction splitting, and token-swapping techniques. The U.S. Justice Department has linked these operations to high-level North Korean officials, including Sim Hyon Sop of the Foreign Trade Bank and Kim Sang Man of the state-linked IT firm Chinyong. The stolen funds are often funneled back to North Korea’s military and weapons programs, highlighting the geopolitical stakes of these cyber operations.

In response to the growing threat, international cooperation has intensified. South Korea and the United States have formalized cybersecurity cooperation agreements targeting North Korean crypto operations. The collaboration involves joint research aimed at preventing cryptocurrency theft and tracking stolen assets. This initiative follows a recent surge in the value of Bitcoin, which has raised concerns about increased cyber attacks. By combining resources and expertise, both nations aim to bolster defenses against the evolving tactics of North Korean cyber actors.

Companies have been advised to enhance their cybersecurity protocols, particularly during the hiring process. CZ emphasized the importance of training employees against downloading suspicious files and implementing rigorous candidate screening procedures. These recommendations are part of broader efforts to mitigate the risk of infiltration by malicious actors operating under false identities. As the cryptocurrency industry continues to expand, so too does the sophistication of the threats it faces, making vigilance and proactive measures essential in safeguarding digital assets.