Kraken feigns interest in hiring North Korean hacker in order to 'study' their tactics

It's not everyday a company makes a big deal about who it didn't hire.

Enter Kraken, which on Thursday said it recently realized a North Korean hacker had applied for an engineering role at the U.S.-based cryptocurrency exchange. Instead of simply contacting the authorities or turning the candidate away, Kraken said it put the candidate through their paces in order to "learn more about their tactics at every stage of the process," the company said in a blog post.

"Our teams recently identified a North Korean hacker’s attempts to infiltrate our ranks by applying for a job at Kraken," the company said. "What started as a routine hiring process for an engineering role quickly turned into an intelligence gathering operation."

North Korea's involvement in crypto-related cybercrime is well documented. "Industry partners had tipped us off that North Korean hackers were actively applying for jobs at crypto companies," Kraken said.

Kraken also pointed to a TechCrunch story that said North Korean-backed hackers were responsible for stealing over $650 million in 2024 and had deployed "IT workers to infiltrate blockchain companies as insider threats." In February, Arkham Intelligence said North Korea's Lazarus Group has behind the Bybit hack for over $1.5 billion, the largest crypto heist of all time.

"Instead of tipping off the applicant, our security and recruitment teams strategically advanced them through our rigorous recruitment process – not to hire, but to study their approach," said Kraken. "This meant putting them through multiple rounds of technical infosec tests and verification tasks, designed to extract key details about their identity and tactics."

Kraken said during a live interview its team managed to trip up the applicant with two-factor authentication prompts "such as asking the candidate to verify their location, hold up a government-issued ID, and even recommend some local restaurants in the city they claimed to be in."

"At this point, the candidate unraveled," Kraken added. "Flustered and caught off guard, they struggled with the basic verification tests, and couldn’t convincingly answer real-time questions about their city of residence or country of citizenship. By the end of the interview, the truth was clear: this was not a legitimate applicant, but an imposter attempting to infiltrate our systems."

Kraken also said that during the investigation, it discovered that "one individual had established multiple identities to apply for roles in the crypto space and beyond." The company also said that "several of the names had previously been hired by multiple companies" with one identity in the network listed as a "foreign agent on the sanctions list."