Skip to main content

Kraken’s Close Call: How a North Korean Hacker Was Unmasked

Kraken details how it spotted North Korean hacker in job interview

In a fascinating turn of events, Kraken, the prominent US cryptocurrency exchange, recently thwarted a sophisticated attempt by a North Korean hacker to infiltrate their organization through a job application. The incident, detailed in a recent blog post, highlights the increasing sophistication of state-sponsored cyberattacks targeting the cryptocurrency industry.

The red flags emerged early in the hiring process for an engineering role. The applicant, using a name different from the one on their application, exhibited unusual behavior, including inconsistencies in their voice and apparent remote guidance during the interview process. Instead of immediate dismissal, Kraken’s security team, alerted to potential North Korean activity by industry partners, made a strategic decision to continue the process, cleverly using the interview as an intelligence-gathering operation.

Information shared by industry partners included a list of email addresses linked to a known North Korean hacker group. A match was found with the email address used in the job application, leading Kraken’s investigation into a broader network of fake identities used to infiltrate multiple companies.

Further scrutiny revealed technical irregularities. The applicant used remote Mac desktops through VPNs, and their identification documents showed clear signs of alteration. A resume linked to a GitHub profile revealed an email address previously compromised in a data breach. Their primary form of ID appeared to be manipulated using data stolen from an identity theft case two years prior.

During the final interview stages, Kraken’s Chief Security Officer, Nick Percoco, implemented additional identity verification checks which the applicant failed, unequivocally confirming their deception. The applicant’s attempted infiltration underscores the persistent threat posed by state-sponsored actors and their relentless efforts to exploit vulnerabilities within the cryptocurrency sector.

This incident serves as a stark reminder: vigilance and robust security measures are critical to safeguarding against the sophisticated tactics employed by these advanced threat actors. Kraken’s proactive approach in this case showcases a critical need for proactive measures within the industry.

The North Korean regime’s persistent targeting of cryptocurrency exchanges highlights the urgent need for heightened security protocols and collaborative efforts across the industry to combat these threats effectively.

Latest Posts