In a real-world cybersecurity thriller, crypto exchange Kraken successfully exposed a North Korean hacker attempting to infiltrate its internal systems by posing as a job candidate.
The hacker targeted an engineering role, hoping to gain insider access to the company’s infrastructure — a move that highlights the evolving strategies of state-sponsored cybercriminals.
Suspicious Signals Trigger Internal Probe
Kraken’s recruitment and security teams initially became suspicious when the applicant joined a call under a different name than on the résumé and awkwardly switched voices mid-interview — a sign of real-time coaching.
Tipped off by industry partners that North Korean actors were actively applying for jobs at crypto firms, Kraken cross-checked the applicant’s email with a known list of compromised accounts tied to the hacking group.
Using Open-Source Intelligence (OSINT) and breach data analysis, Kraken uncovered a network of fake identities connected to previous hires at multiple companies. The candidate’s use of VPNs, suspicious GitHub activity, and a likely forged ID only deepened the concern.
Turning the Tables Through a Trap Interview
Instead of rejecting the applicant outright, Kraken advanced them through the interview stages to gather more intel. The final round was a subtle sting operation involving Kraken CSO Nick Percoco, who led a carefully crafted interview that included location verification questions and ID prompts. The hacker failed the live-test miserably.
The incident underscores a new reality for the crypto industry: threats don’t just come through code but also through job portals. As Kraken’s CSO noted, “Don’t trust, verify” has never been more critical — especially when national security is at stake.
Source: https://coindoo.com/kraken-outsmarts-north-korean-hacker-posing-as-job-applicant/