Skip to content
North Korea Hackers Use Job Scams to Target Crypto Firms

North Korea Hackers Use Job Scams to Target Crypto Firms

First seen 31 Jan 2026, 20:40 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 25, 2026 at 05:13 UTC

Fireblocks disrupted a North Korea-linked job recruitment scam that targeted crypto firms by using fake interviews and assignments to install malware. The hackers impersonated recruiters and conducted interviews via Google Meet, aiming to compromise developers with privileged access to digital assets. This operation mirrors tactics used by North Korea's Lazarus Group, which previously stole $1.5 billion from Bybit in 2025.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 204d ago How this analysis works

More articles in this cluster (386)

Following this threat?

Track Kimsuky and Bybit in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed