North Korean Infiltration in Tech Recruitment
A recent incident with UK-based verification startup Cheqd has highlighted an alarming trend in the recruitment process, revealing how North Korean operatives are attempting to infiltrate the tech and crypto sectors. During a second-stage interview that included a live coding test, a software developer initially presented as a competent candidate—fluent in English and based in Europe—underwent a noticeable transformation. They exhibited a distinctly Asian accent, struggled with poor internet connectivity, and encountered technical issues with their camera. More worryingly, during a review of the coding session, Cheqd discovered the individual’s screen recordings revealed them navigating pages in Korean, indicating a possible ruse.
Patterns of Deception
Fraser Edwards, the CEO of Cheqd, disclosed to Decrypt that this candidate was part of about five similar attempts by suspected North Korean operatives to gain employment at his company within the past year. This incident reflects broader tactics employed by North Korea, which reportedly aims to hire foreigners as a front to facilitate entry into overseas organizations, particularly within tech and crypto. Edwards noted striking patterns whereby first-round candidates who presented with European accents later reappeared with Asian accents in subsequent interviews.
Cybersecurity Concerns
The urgency of this issue is underscored by cybersecurity firm Chainalysis, which reported that hackers stole over $2.2 billion from crypto companies in 2024 alone, marking a 21% increase from the previous year. A staggering 61%, approximately $1.34 billion, of these losses were traced back to North Korean state-sponsored operators, with analysts suggesting an uptick in such cyber attacks.
Chainalysis emphasized the rising frequency of these crypto assaults, linking many breaches to North Korean IT professionals infiltrating crypto and Web3 companies, exploiting their networks, and undermining operational integrity by utilizing advanced tactics. These methodologies often involve fake identities and remote work strategies to bypass recruitment vetting.
Industry Response
Unfortunately, Cheqd is not isolated in this predicament; numerous crypto firms have recently faced similar infiltration attempts. Earlier in the year, Kraken, a major cryptocurrency exchange, reported a targeted effort but successfully managed to apprehend the perpetrator before an employment offer was extended.
Recruiters like Owen Healey, who oversees a blockchain talent agency in Ireland, noted a concerning shift towards recruiting candidates primarily from Europe, especially in initial interview stages, to avoid any potential North Korean infiltration. Healey has become well-acquainted with identifying such deceptive candidates and has shared tactics on LinkedIn to assist others in the industry. He suggests engaging candidates in discussions about popular culture or their claimed locations, noting a common pattern of candidates claiming to live in Toronto as an attempt to seem legitimate. However, he cautioned that these new strategies might soon render such techniques ineffective, as North Korean operatives adapt their tactics.
Implications for Remote Hiring
The implications of this trend are profound, particularly regarding companies’ approaches to remote hiring from Asia, where legitimate applicants could be mistakenly categorized as fraudulent due to the geographical overlap.
As the landscape of recruitment evolves, many sectors, not restricted to crypto, are confronting difficulties associated with the rise of AI-generated CVs and cover letters, complicating traditional hiring processes. An anonymous recruiter expressed frustration over the influx of unvetted applications filled with generic phrases from AI tools like ChatGPT, leading to both skill misrepresentations and an increased administrative burden in evaluating candidate qualifications.
Strengthening Recruitment Strategies
As companies seek methods to ensure legitimate talent, the challenge is further intensified by emerging technologies aiding individuals in deceptive practices—an issue exemplified by the recent launch of Cluely, a startup created by a former Columbia University student, designed to assist candidates in academic and job interview deceit.
Faced with these challenges, Cheqd has recognized the necessity to fortify its recruitment strategies. As they seek to fill new positions, Edwards expressed a shift towards relying on established professional networks for referrals, underscoring a shift that may disadvantage job seekers lacking such connections.
“We might just bypass market posting entirely, which creates a significant barrier for those without networks,”
he remarked, reflecting the growing complexities of navigating this evolving job landscape.
