From Fake Recruiters to $6 Billion Heists
Cointime reports: In March 2024, an employee at Japanese wallet provider Ginco connected on LinkedIn with a supposed recruiter offering a coding test. Two months later, attackers used hijacked session tokens to impersonate that employee and likely altered a routine transaction request tied to DMM Bitcoin. The result: 4,502.9 BTC — roughly $308 million at the time — vanished. The entry point wasn’t a masked robber but a job offer.
This pattern is now central to how North Korea-linked actors operate. The FBI’s TraderTraitor label, also applied to the October 31, 2026 Binance incident involving over $6 billion in stolen virtual assets, points to a broader truth: attacks are entering crypto firms through hiring pipelines, developer devices, and vendor systems, not just wallet code.
Beyond the Lazarus Myth
Lazarus, Bluenoroff, Andariel, APT38 — these are external tags for a network tied to North Korea’s Reconnaissance General Bureau. Public evidence shows a supply chain of trained personnel, front companies like Chosun Expo Joint Venture, and prosecuted individuals such as Park Jin-hyuk, who held legitimate coding jobs while allegedly supporting state-backed operations. The image of a lone genius hacker obscures a structured, income-generating apparatus.
The mission set is broad: the 2014 Sony Pictures attack, the 2016 Bangladesh Bank theft, WannaCry in 2017, and now crypto. Digital assets offer something traditional banking cannot — near-instant, permissionless transfer once signing authority is compromised.
Targeting the Human Layer
Early campaigns like AppleJeus distributed malware through fake trading software. By 2022, cross-chain bridges became prime targets: Ronin lost 173,600 ETH and $25.5 million USDC after attackers obtained five of nine validator signatures. Harmony’s Horizon bridge lost about $100 million. The lesson: protocol rules can be sound, but if signing authority is centralized or display interfaces are tampered with, approvals become theater.
Bybit’s February 2025 loss of roughly $1.5 billion exposed a subtler flaw. Attackers compromised Safe wallet infrastructure and injected malicious code into the signing interface. Signers approved what looked like normal transactions; the signatures were genuine, but the understanding was false. Cold storage alone does not solve this.
The Binance case adds another vector: a DevOps engineer’s computer may have been compromised, granting container access and unauthorized withdrawal requests, with no evidence of private key leakage. The intrusion began far from the funds.
Fake Employees and Laptop Farms
A parallel route involves attackers applying for remote tech jobs using stolen identities. In June 2025, the DOJ disrupted a network using U.S.-based “laptop farms” to host employer devices while overseas workers connected remotely. In one case, insiders with access to crypto firms allegedly modified smart contract source code, stealing over $900,000 combined.
For employers, a remote colleague who delivers work on time may gradually gain permissions over code deployment, production systems, or wallet operations. The initial identity gap grows with every access grant.
Laundering Is the Other Half
Stealing $1.5 billion is not the same as spending it. Attackers quickly convert assets to Bitcoin and disperse them across chains. The 2020 prosecution of Chinese nationals Tian Yinyin and Li Jiadong, accused of laundering over $100 million for North Korea-linked hackers, showed that cash-out networks — and even infrastructure funding — are integral to the operation.
Attribution requires linking wallet addresses to accounts, devices, reused emails, and malware code. Chain data alone cannot reveal nationality.
What Comes Next
The crypto industry’s openness enables global collaboration — and global exploitation. Firms must treat hiring, vendor access, signing interfaces, and DevOps permissions as critical attack surfaces. Independent transaction verification, hardware-level display integrity, strict privilege separation, and identity checks that persist beyond onboarding are no longer optional. The cost of openness is borne silently by those who build without defending the human layer.
