Binance co-founder warned about North Korean hackers after the white hat SEAL team uncovered the profiles and fake names of 60 impersonators.
News
North Korean hackers are stepping up efforts to infiltrate cryptocurrency companies by posing as IT workers, raising fresh security concerns for the industry, according to Binance co-founder Changpeng “CZ” Zhao and a team of ethical hackers.
CZ the alarm Thursday on X about the growing threat of North Korean hackers seeking to infiltrate crypto companies through employment opportunities and even bribing exchange staff for data access.
“They pose as job candidates to try to get jobs in your company. This gives them a “foot in the door,” specifically for employment opportunities related to development, security and finance, CZ said.
“They pose as employers and try to interview/offer your employees. During the interview, they will be a problem with Zoom and they will send your employee a link to an “update”, which contains virus that will takeover your employee’s device.”
Other North Korean agents give employees coding questions to send them malicious “sample code” later, pose as users to send malicious links to customer support, or even “bribe your employees, outsourced vendors for data access,” Zhao said.
“To all crypto platforms, train your employees to not download files, and screen your candidates carefully,” he added.
Related:
The warning follows similar concerns from Coinbase, which last month.
In response, Coinbase CEO Brian Armstrong introduced new internal security measures, including requiring all workers to receive in-person training in the US, while people with access to sensitive systems will be required to hold US citizenship and submit to fingerprinting.
“We can collaborate with law enforcement […] but it feels like there’s 500 new people graduating every quarter, from some kind of school they have, and that’s their whole job,” Armstrong told Cheeky Pint podcast host John Collins.
Related:
Zhao’s warning came as a group of ethical hackers called Security Alliance (SEAL) compiled the profiles of at least 60 North Korean agents posing as IT workers under fake names seeking to infiltrate US crypto exchanges and steal sensitive user data.
“North Korean developers are eager to work for your company, but it’s important to not get scammed by impostors when hiring,” Security Alliance said in a Wednesday X , sharing its new repository for North Korean impersonators.
The repository contains key information on North Korean impersonators, including aliases, fake names and email used, along with websites, both real and fake citizenships, addresses, locations and the numbers of firms that hired them.
Salary details, GitHub profiles and all other public associations are also included for each impersonator.
In June, four North Korean operatives infiltrated multiple crypto firms as freelance developers, stealing a cumulative startups, illustrating the growing threat, Cointelegraph reported.
The team was formed to combat these exploits, led by white hat hacker and Paradigm researcher Samczsun. SEAL conducted more than 900 hack-related investigations within a year of its launch, illustrating the growing need for ethical hackers, Cointelegraph reported in August 2024.
North Korean hackers like the are the main suspects behind some of the most devastating cryptocurrency heists, including the , the industry’s largest so far.
Throughout 2024, North Korean hackers stole over $1.34 billion worth of digital assets across 47 incidents, a 102% increase from the $660 million stolen in 2023, to Chainalysis data.
Magazine:
