Kraken, a well-known cryptocurrency exchange, has thwarted a sophisticated attempt by a North Korean hacker masquerading as a job applicant. The company's security and recruitment teams purposely moved the candidate through the hiring process to observe their methods and gain valuable insights.

The incident was disclosed by Kraken in a recent blog post on May 1. The hacker applied for an engineering position at the exchange under the name Steven Smith but raised suspicion due to various inconsistencies during the recruitment process.

Kraken's investigation uncovered that the candidate used multiple identities and an email associated with North Korean hackers. Technical irregularities, like using remote Mac desktops accessed via a VPN and altered IDs, confirmed the attempted infiltration by a likely state-sponsored hacker.

In a final interview, Kraken's Chief Security Officer, Nick Percoco, exposed the candidate as an impostor when they failed to provide clear location verification or answer questions about their background.

Furthermore, the US Financial Crimes Enforcement Network (FinCEN) has proposed banning Huione Group, based in Cambodia, from the US financial system for its ties to North Korean hacker groups. Huione was accused of facilitating cyber heists and fraudulent cryptocurrency schemes, laundering over $4 billion in illicit funds between August 2021 and January 2025.

These events shed light on the recurring North Korean cyberattacks on the cryptocurrency industry, including high-profile thefts from crypto companies. The US, Japan, and the Republic of Korea issued a joint statement detailing how North Korean hackers employed tactics like social engineering and malware to target the sector.

Notably, reports have linked North Korean hacker groups, such as Lazarus Group, to various crypto-related hacks, emphasizing the pervasive involvement of North Korean entities in the cryptocurrency space. Moreover, recent investigations have revealed substantial North Korean participation in decentralized finance (DeFi) protocols, with some protocols heavily reliant on funds from the Democratic People's Republic of Korea (DPRK).