{"id":486070,"date":"2025-06-20T12:04:09","date_gmt":"2025-06-20T11:04:09","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=486070"},"modified":"2025-06-20T12:08:06","modified_gmt":"2025-06-20T11:08:06","slug":"north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/","title":{"rendered":"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer"},"content":{"rendered":"

A new wave of cyberattacks shows the DPRK is exploiting the crypto industry's recruitment funnel, using fake LinkedIn job offers, deep\u2011fake Zoom calls, and backdoored interview files to access Web3 developers\u2019 wallets and repositories.<\/p>\n

With seasoned developer talent already thinning and open\u2011source protocols increasingly reliant on individual contributors, the stakes have never been higher.<\/p>\n

North Korean hackers developer infiltration<\/h2>\n

On 18\u202fJune\u202f, cybersecurity firm Huntress reported<\/a> a campaign attributed to BlueNoroff, a notorious Lazarus Group subgroup targeting a developer at a major Web3 foundation.<\/p>\n

The ruse began with a polished recruiter pitch on LinkedIn, followed by what appeared to be a Zoom interview with a senior executive. In reality, the video feed was a deep\u2011fake, and the \u201ctechnical\u2011assessment\u201d file the candidate was asked to run<\/a>, `zoom_sdk_support.scpt`, deployed cross\u2011platform malware dubbed BeaverTail that can harvest seed phrases, crypto\u2011wallets, and GitHub credentials.<\/p>\n

These tactics represent a sharp escalation. \u201cIn this new campaign, the threat\u2011actor group is using three front companies in the crypto consulting industry \u2026 to spread malware via \u2018job\u2011interview lures,\u2019\u201d researchers at Silent Push wrote in April<\/a>, referring to companies such as BlockNovas, SoftGlide, and Angeloper. All three maintained U.S. corporate registrations and LinkedIn job posts that easily passed HR sniff tests.<\/p>\n

The FBI seized the BlockNovas<\/a> domain in April\u202f. By then, multiple developers had reportedly sat through fake Zoom calls where they were urged to install custom apps or run scripts. Many complied.<\/p>\n

These aren\u2019t simple smash\u2011and\u2011grab scams but part of a well\u2011funded, state\u2011directed campaign. Since 2017, North Korean hacking groups have stolen over\u202f$1.5\u202fbillion in crypto<\/a>, including the $620\u202fmillion Ronin\/Axie Infinity hack.<\/p>\n

The stolen assets are routinely funneled through mixers such as Tornado\u202fCash and Sinbad, laundering Pyongyang\u2019s take and ultimately bankrolling its weapons programme, according to the U.S. Treasury.<\/p>\n

\u201cFor years, North Korea has exploited global remote IT contracting and crypto ecosystems to evade U.S. sanctions and bankroll its weapons programs,\u201d said Sue\u202fJ.\u202fBai<\/a> of the DoJ\u2019s National Security Division. On 16\u202fJune, her office announced the seizure of $7.74\u202fmillion in crypto tied to the fake\u2011IT\u2011worker scheme.<\/p>\n

Crypto developer focus<\/h2>\n

The targets are carefully selected. The open\u2011source nature of crypto protocols means that a single engineer, often pseudonymous and globally distributed, may hold commit privileges to critical infrastructure, from smart contracts to bridge protocols.<\/p>\n

Electric Capital\u2019s most recent publicly available Developer Report<\/a> counted about 39,148 new active crypto developers, with total developers down roughly 7% year\u2011on\u2011year. Industry analysts say the supply of seasoned maintainers has only tightened, making each compromised developer disproportionately dangerous.<\/p>\n

That imbalance is why the hiring pipeline itself has become a cybersecurity battleground. Once a front\u2011company recruiter gets past HR, engineers, eager for stability in a bearish market, may not spot the red flags in time. In several cases, the attackers even used<\/a> Calendly links and Google\u202fMeet invites that silently redirected victims to attacker\u2011controlled Zoom look\u2011alike domains.<\/p>\n

The malware stack is advanced and modular. Huntress and Unit\u202f42 have catalogued<\/a> BeaverTail, InvisibleFerret, and OtterCookie variants, all compiled with the Qt framework for cross\u2011platform compatibility. Once installed, the tools scrape browser extensions such as MetaMask and Phantom, exfiltrate `wallet.dat` files, and search for terms like \u201cmnemonic\u201d or \u201cseed\u201d in plaintext files.<\/p>\n

Yet despite the technical sophistication, law\u2011enforcement pressure is mounting. The FBI\u2019s domain seizures, the DoJ\u2019s financial forfeitures, and Treasury sanctions on mixers have begun to raise the cost of doing business for Pyongyang\u2019s hackers. The regime, however, remains adaptive.<\/p>\n

Each new shell company, recruiter persona, or malware payload arrives wrapped in more convincing packaging. Thanks to generative\u2011AI tools, even the fake executives in live calls<\/a> now look and move credibly. DeFi\u2019s trustless systems still rely on a surprisingly small and vulnerable circle of trusted human maintainers.<\/p>\n

North Korean crypto target onslaught<\/h2>\n

Recent CryptoSlate<\/em> coverage paints a broader canvas of Pyongyang\u2019s crypto onslaught. One year-end analysis found that North Korea-linked groups siphoned $1.34 billion from 47 hacks in 2024, which was a total of 61 % of all crypto stolen<\/a> that year.<\/p>\n

A big slice of that tally came from the $305 million breach of Japan\u2019s DMM Bitcoin, which the FBI says started when a TraderTraitor operative posed as a LinkedIn recruiter and slipped a malicious \u201ccoding test\u201d to a Ginco wallet<\/a> engineer.<\/p>\n

The same playbook escalated this February when the bureau attributed a record $1.5 billion Bybit exploit to Lazarus, noting the thieves had already laundered 100,000 ETH through THORChain<\/a> within days.<\/p>\n

North Korean operatives are impersonating venture capitalists, recruiters, and remote IT workers, using AI-generated profiles and deep-fake interviews, to earn salaries, exfiltrate source code, and extort firms in what Microsoft researchers call a \u201c<\/span>triple-threat<\/a>\u201d scheme.<\/span><\/p>\n

In a world where jobs can be remote, trust is digital, and software runs the money, the subsequent state\u2011sponsored breach may begin not with an exploit but with a handshake.<\/p>\n","protected":false},"excerpt":{"rendered":"

A new wave of cyberattacks shows the DPRK is exploiting the crypto industry’s recruitment funnel, using fake LinkedIn job offers, deep\u2011fake Zoom calls, and backdoored interview files to access Web3 developers\u2019 wallets and repositories. With seasoned developer talent already thinning and open\u2011source protocols increasingly reliant on individual contributors, the stakes have never been higher. North […]<\/p>\n","protected":false},"author":1264,"featured_media":486106,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[76799,16041,9836],"tags":[],"prediction_market_topic":[],"post_folder":[],"acf":[],"yoast_head":"\nYou\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer<\/title>\n<meta name=\"description\" content=\"North Korea\u2019s hackers are no longer just phishing; they\u2019re hiring.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep\u2011fakes-to-infiltrate-crypto-developer-networks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer\" \/>\n<meta property=\"og:description\" content=\"North Korea\u2019s hackers are no longer just phishing; they\u2019re hiring.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep\u2011fakes-to-infiltrate-crypto-developer-networks\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-20T11:04:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-20T11:08:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/06\/northkorean-hacker-.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Liam 'Akiba' Wright\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@akibablade\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Liam 'Akiba' Wright\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#person\",\"name\":\"Liam 'Akiba' Wright\",\"url\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg\",\"caption\":\"Liam 'Akiba' Wright\"},\"jobTitle\":\"Editor-in-Chief\",\"description\":\"Liam \u201cAkiba\u201d Wright is CryptoSlate\u2019s Editor-in-Chief, reporter and podcast producer, focused on decentralized tech\u2019s positive impact.\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/www.akiba.gg\",\"https:\/\/x.com\/akibablade\",\"https:\/\/www.linkedin.com\/in\/liamandrewwright\",\"https:\/\/muckrack.com\/liam-wright\"]},\"headline\":\"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer\",\"datePublished\":\"2025-06-20T11:04:09+00:00\",\"dateModified\":\"2025-06-20T11:08:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/\"},\"wordCount\":837,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"articleSection\":[\"Crime\",\"Hacks\",\"Scams\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/\",\"url\":\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/\",\"name\":\"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2025-06-20T11:04:09+00:00\",\"dateModified\":\"2025-06-20T11:08:06+00:00\",\"description\":\"North Korea\u2019s hackers are no longer just phishing; they\u2019re hiring.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e\",\"name\":\"Liam 'Akiba' Wright\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg\",\"caption\":\"Liam 'Akiba' Wright\"},\"description\":\"Also known as \\\"Akiba,\\\" Liam Wright is the Editor-in-Chief at CryptoSlate and host of the SlateCast. He believes that together decentralized blockchain and AI technology have the potential to make widespread positive change.\",\"sameAs\":[\"https:\/\/www.akiba.gg\",\"https:\/\/www.instagram.com\/akibablade\",\"https:\/\/twitter.com\/akibablade\"],\"award\":[\"Most improved footballer - 1992\"],\"knowsAbout\":[\"Python\",\"Javascript\",\"PHP\",\"HTML\",\"Agentic Software\",\"Machine Learning\",\"2000s emo music\",\"Manchester United\"],\"knowsLanguage\":[\"English\",\"Spanish\"],\"url\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer","description":"North Korea\u2019s hackers are no longer just phishing; they\u2019re hiring.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep\u2011fakes-to-infiltrate-crypto-developer-networks\/","og_locale":"en_US","og_type":"article","og_title":"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer","og_description":"North Korea\u2019s hackers are no longer just phishing; they\u2019re hiring.","og_url":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep\u2011fakes-to-infiltrate-crypto-developer-networks\/","og_site_name":"CryptoSlate","article_published_time":"2025-06-20T11:04:09+00:00","article_modified_time":"2025-06-20T11:08:06+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/06\/northkorean-hacker-.jpg","type":"image\/jpeg"}],"author":"Liam 'Akiba' Wright","twitter_card":"summary_large_image","twitter_creator":"@akibablade","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Liam 'Akiba' Wright","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#person","name":"Liam 'Akiba' Wright","url":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg","caption":"Liam 'Akiba' Wright"},"jobTitle":"Editor-in-Chief","description":"Liam \u201cAkiba\u201d Wright is CryptoSlate\u2019s Editor-in-Chief, reporter and podcast producer, focused on decentralized tech\u2019s positive impact.","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/www.akiba.gg","https:\/\/x.com\/akibablade","https:\/\/www.linkedin.com\/in\/liamandrewwright","https:\/\/muckrack.com\/liam-wright"]},"headline":"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer","datePublished":"2025-06-20T11:04:09+00:00","dateModified":"2025-06-20T11:08:06+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/"},"wordCount":837,"commentCount":0,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"articleSection":["Crime","Hacks","Scams"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/","url":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/","name":"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2025-06-20T11:04:09+00:00","dateModified":"2025-06-20T11:08:06+00:00","description":"North Korea\u2019s hackers are no longer just phishing; they\u2019re hiring.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/north-korea-leverages-fake-job-offers-and-deep%e2%80%91fakes-to-infiltrate-crypto-developer-networks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"You\u2019re Hired! North Korea\u2019s new crypto scam starts with a job offer"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e","name":"Liam 'Akiba' Wright","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg","caption":"Liam 'Akiba' Wright"},"description":"Also known as \"Akiba,\" Liam Wright is the Editor-in-Chief at CryptoSlate and host of the SlateCast. He believes that together decentralized blockchain and AI technology have the potential to make widespread positive change.","sameAs":["https:\/\/www.akiba.gg","https:\/\/www.instagram.com\/akibablade","https:\/\/twitter.com\/akibablade"],"award":["Most improved footballer - 1992"],"knowsAbout":["Python","Javascript","PHP","HTML","Agentic Software","Machine Learning","2000s emo music","Manchester United"],"knowsLanguage":["English","Spanish"],"url":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/486070"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/1264"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=486070"}],"version-history":[{"count":9,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/486070\/revisions"}],"predecessor-version":[{"id":486128,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/486070\/revisions\/486128"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/486106"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=486070"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=486070"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=486070"},{"taxonomy":"prediction_market_topic","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/prediction_market_topic?post=486070"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=486070"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}