North Korean hackers are increasingly impersonating recruiters to steal cryptocurrency, saturating the industry with convincing fake job offers, according to new research and interviews conducted by Reuters. The cyber campaign, dubbed “Contagious Interview” by cybersecurity firms, has grown so pervasive that many applicants now screen recruiters to ensure they are not acting on behalf of Pyongyang.
Experts say North Korea stole at least $1.34 billion in cryptocurrency last year, funding its sanctioned weapons program. The FBI has previously warned that Pyongyang was “aggressively” targeting the crypto industry with elaborate social engineering schemes.
The scams typically begin on LinkedIn or Telegram, with a recruiter offering a role at a major blockchain or crypto firm. Applicants are then directed to obscure websites to complete a skills test or record a video—sometimes requiring them to download malicious code. In one case, a U.S. product manager lost $1,000 in ether and Solana after sending a video to a fake recruiter impersonating Ripple Labs. Others, like consultant Ben Humbert, cut off conversations after being asked to complete “virtual interviews” through suspicious links.
Companies such as Robinhood and Kraken have acknowledged being impersonated. Robinhood said it acted to disable fake web domains linked to the scam. LinkedIn and Telegram confirmed that the fraudulent accounts identified by Reuters had been removed. Still, security experts say the impersonations are difficult to police, as “anybody out there can say they’re a recruiter,” noted Nick Percoco, Kraken’s chief security officer.
Research by SentinelOne and Validin found exposed hacker log files containing details of more than 230 targeted individuals—ranging from coders and consultants to executives—between January and March. Analysts linked the activity to North Korea based on IP addresses and emails tied to previous state-backed hacks.
Although only a fraction of North Korea’s overall crypto theft efforts, experts warn the campaign is highly organized and rapidly evolving. “It’s scary how far they’ve come,” said Carlos Yanez of Global Ledger, one of the recent targets.
North Korea’s mission to the United Nations did not respond to Reuters’ request for comment, though Pyongyang routinely denies involvement in cryptocurrency theft.