Archive · 4 Sep 2025
North Korean Hackers Impersonate Recruiters to Steal Crypto
Imagine bad guys from North Korea pretending to be job recruiters for cryptocurrency companies.
They contact people looking for jobs, often through LinkedIn or Telegram.
They offer great-sounding positions, but it's all a trick.
The fake recruiters ask potential hires to do things like download special software or record videos.
Once the targets do this, the hackers can steal their digital money, like Bitcoin.
This has been happening a lot, and it's getting more and more difficult to spot.
The hackers are getting better at pretending to be legitimate, making it very tricky for people to know who to trust.
The money stolen is thought to be used to fund dangerous weapons programs.
North Korean hackers are using fake job offers to steal cryptocurrency.
They contact potential victims via LinkedIn and Telegram.
Targets are tricked into running code or recording videos.
Victims have lost cryptocurrency by following instructions.
Experts say the scams are widespread and improving.
- Who
- North Korean hackers are impersonating recruiters.
- What
- They are using fake job offers to steal cryptocurrency.
- When
- The activity has been ongoing, with reports persisting through March, April, and May.
- Where
- The attacks target the cryptocurrency industry globally.
- Why
- To support North Korea's sanctioned weapons program.
- Target Industry
- Cryptocurrency
- Primary Actors
- North Korean Hackers
- Primary Method
- Fake Job Offers
- Impersonated Companies
- Ripple Labs, Bitwise Asset Management, Kraken, Robinhood
- Stolen Cryptocurrency (estimated)
- $1.34 billion (last year)
- Identified Targets
- 230+