North Korea’s fake recruiters and fake job applicants

North Korea has learnt to use hiring as a way in, from both sides of the interview. Posing as a recruiter, it offers your engineers a job and asks them to run a coding test that installs its malware. That is how Binance says an attacker got onto an engineer's work computer in September 2026, the second of four stages that ended on 29 October with about $6.34 billion of digital assets taken, a theft the FBI attributes to North Korea. Posing as an applicant, it borrows someone's identity, gets through a coached video interview and, once hired, asks for the company laptop to be sent to a helper's home. Kraken caught one such applicant in 2025; a Japanese crypto exchange caught another. This article is built mostly from pictures, for the people who hire and the people who get hired: what happened, how each scheme works, the red flags, and which team can stop it. For North Korea's wider aims, see our analysis of the four state actors.

What happened, and what is confirmed

Status as of 4 November 2026. "Which door" refers to Figure 1 below: Door 1 is the fake recruiter, Door 2 the fake applicant.

Case	Status	What happened
Binance, June – October 2026 · Door 1	Confirmed by Binance; the FBI attributes it to North Korea	An engineer downloaded an interview "assignment" onto his work computer. With a tampered installer from June and an internal AI tool, the attacker reached wallet signing and took about $6.34 billion on 29 October.
DMM Bitcoin via Ginco, 2024 · Door 1	Attributed by the FBI and the NPA	A "recruiter" on LinkedIn sent a Ginco employee a Python "pre-employment test". The attackers later altered a DMM transaction: 4,502.9 BTC, about $308 million (about ¥48.2 billion).
WaterPlum ("Contagious Interview"), Dec 2025 – Jul 2026 · Door 1	Attributed by Japan, the US, Australia and Germany	Fake employers asked developers to run coding tests. At least 30,000 PCs in more than 100 countries were infected and over 7,000 crypto wallets emptied or their credentials taken.
Kraken, 2025 · Door 2	Kraken's own account; not hired	Kraken spotted a North Korean applicant, kept them in the process to study them, and watched them fail live checks in the final interview.
A Japanese crypto exchange, May 2025 · Door 2	Reported by the NPA; not hired	An applicant for an engineering job posed as someone else. The company noticed oddities in the interview.
Laptop farms in Japan and the US · Door 2	Reported by the NPA and the U.S. Justice Department	Japan's first laptop farm for North Korean IT workers was found, with several hundred million yen sent abroad. In Texas, 187 laptops and KVM devices were seized.

NPA is Japan's National Police Agency. "Attributed" means the authorities named North Korea; it is not a court finding.

Two doors into the same company

Figure 1. Original graphic built from Binance's, Kraken's and the authorities' own accounts.

The two doors are run by the same state. Japan's NPA and the FBI assess that WaterPlum, the group behind the fake interviews, and some North Korean IT workers both operate under the 313 General Bureau of the Munitions Industry Department of the Workers' Party's Central Committee. Some WaterPlum operators also work as IT workers from the same internet addresses. One door steals; the other earns salaries and opens a door from the inside. The NPA says the IT workers' earnings fund North Korea's nuclear and missile programmes.

For a general reader: if a stranger offers you a job and then asks you to run their software, assume it is an attack. If a candidate will not keep their camera on, cannot talk about the city they say they live in, or wants their laptop sent somewhere else, assume the same.

Door 1: the recruiter who isn't

Binance: four stages, three engineers

Figure 2. Original graphic built from Binance's incident updates and the FBI's alert. Columns are not to scale.

Binance's own account describes three engineers and four stages.

June: a tampered installer. Engineer A, who works on wallet operations, searched the web for a popular AI coding tool and installed a tampered Homebrew package along the way. Binance's security team detected it and replaced the device. But, in Binance's words, Engineer A's role and his colleagues on the wallet infrastructure team were now exposed to the attacker.
September: the fake recruiter. Engineer B was contacted on a legitimate job-hunting platform by someone posing as the Project Director of a fictitious company; his profile mentioned his Binance experience. A first-round interview with an "HR representative" was followed by a second with the company's "CEO", who shared personal social-media content to build trust. In the second round he was told to download an "assignment" containing a malicious code repository, and he did so on his work computer.
20 October: an internal AI tool. Working from Engineer B's computer, the attacker used an internal AI tool to gain control over Engineers A and C. Binance has since rebuilt that tool and its access controls.
29 October: the theft. Binance's first update said a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorised withdrawals, and that it had found no evidence that any wallet private key had leaked. The later update says the attacker reached an internal wallet-signing service and used Ethereum's EIP-7702 authorisation feature, outside Binance's normal withdrawal infrastructure.

The damage and the response. Binance estimates the impact at about $6.34 billion and says that by 31 October it had replenished 98% of the affected token assets, verifiable on its proof-of-reserves page. It also reports about $2.85 billion frozen or intercepted. On 31 October the FBI attributed the theft of "more than $6 billion" to North Korea's TraderTraitor, saw the funds being converted mainly into Ether, and asked exchanges and other services to block the laundering addresses. Binance relies on that attribution rather than making its own, and says its findings will be reviewed independently.

The detail that matters most for everyone else. Binance was not careless about this threat. It says it stopped 57 suspected North Korea-linked cases in 2026, and two days before the theft it said it had blocked several fake-interview attacks the previous week with no losses, as Wu Blockchain relayed. One engineer running one "assignment" on a work computer was enough, because that computer could reach tools that reached the wallets.

How a fake interview works

Figure 3. Original graphic. The green boxes are the moments a target, or the company around them, could have stopped the chain.

Japan saw this first at DMM Bitcoin. In late March 2024, according to the FBI and the NPA, someone posing as a recruiter on LinkedIn contacted an employee of Ginco, a Japanese company that makes wallet software for businesses. The "pre-employment test" was a malicious Python script on GitHub, and the employee ran it. From mid-May, the attackers used the employee's stolen session cookies to get into Ginco's unencrypted messaging system. In late May they altered a legitimate transaction request from a DMM employee, and 4,502.9 BTC, worth about $308 million at the time, went to wallets they controlled.

Since then it has become a mass campaign. On 18 September 2026, Japan's NPA and National Cybersecurity Office, the FBI, the U.S. Defense Cyber Crime Center, Australia's Cyber Security Centre and Germany's BND and BfV publicly attributed WaterPlum, also called Contagious Interview (joint advisory, PDF; NPA). Posing as employers, often AI, crypto or NFT firms, the group asks developers to complete a coding test or to fix an error in a video-call tool. Running it installs malicious npm packages carrying BeaverTail, InvisibleFerret, OtterCookie or OtterCandy, or runs a task hidden in a VS Code project. From December 2025 to July 2026 it infected at least 30,000 PCs in more than 100 countries, including Japan, and moved at least ¥1.7 billion ($10.71 million) out of more than 7,000 wallets.

Door 2: the applicant who isn't

Kraken: interviewing a North Korean on purpose

Figure 4. Original graphic built from Kraken's account and the NPA's alert of 18 September 2026.

In a post on 1 May 2025, Kraken described an applicant for an engineering job who turned out to be North Korean. In the first call with a recruiter, the applicant joined under a different name from the one on the CV and quickly changed it, and occasionally switched voices, which suggested someone was coaching in real time. Industry partners had shared a list of email addresses linked to North Korean hackers, and the applicant's address was on it. Kraken's red team found that the address belonged to a network of fake identities, that the applicant's GitHub profile used an email exposed in an earlier data breach, and that the ID appeared to have been altered with details stolen in an identity theft two years before.

Kraken kept the applicant in the process, "not to hire, but to study their approach". In the final interview, its security chief asked the candidate to confirm their location, hold a government ID up to the camera and recommend restaurants in the city they claimed to live in. The candidate could not. Kraken's advice is that live, unprompted checks catch what documents miss, and that interviewers should vary the questions so they cannot be rehearsed.

The same thing in Japan

A Japanese exchange caught one too. The NPA's alert of 18 September says that in May 2025 an applicant for an engineering post at a Japanese crypto exchange posed as someone else, and the company noticed oddities in the interview and did not hire. The same alert describes IT workers using the AI face-swap tool Magicam for only a few minutes, then advising each other to turn the camera off and blame the network.

What to look for, according to Japan and its allies. On 31 July 2026, the NPA, the National Cybersecurity Office, the Ministry of Foreign Affairs, the Ministry of Finance and the Ministry of Economy, Trade and Industry issued a joint alert with the United States, South Korea and other partners (NPA; MOFA). North Korean IT workers pose as other nationals on job and freelance platforms, use translation services and language models to write convincing profiles, and can be spotted by mismatches with photo ID, video that looks altered or generated, refusal to join video calls, rates well below the market, signs that several people run one account, and requests to be paid in crypto. The alert asks platforms to check identity documents strictly and to require interviews in person.

The laptop farm

Figure 5. Original graphic built from the NPA's alert of 18 September 2026 and the U.S. Justice Department's actions of October 2026.

A fake remote employee needs a helper in the country. Companies ship laptops to a home address, and a login from abroad would stand out. So an "enabler" hosts the laptops at home and lets the worker abroad operate them through KVM switches or remote-access tools. In September 2026 the NPA said it had identified the first such laptop farm in Japan, with several hundred million yen, including crypto, sent abroad. Japanese enablers supplied PCs at home, their ID images were misused, and their bank accounts received the pay. The NPA warns that hiring or paying North Korean IT workers, or helping them earn foreign currency, may break Japanese law and sanctions.

In the United States, the Justice Department announced on 13 October 2026 that agents had searched more than 40 homes in Texas and seized 187 laptops and KVM devices (Northern District of Texas). The FBI in Dallas said each laptop potentially represents one company that hired a North Korean worker. A separate Ohio indictment charges 14 people over a scheme that reached more than 70 U.S. companies and earned about $3 million (Northern District of Ohio).

Exposure does not always end it. The NPA reports that one IT worker extorted a client and published its source code, and another defaced a client's website.

By the numbers

Figure 6. Original graphic. Theft values are those the FBI or the victim gave at the time; Bybit's is from the FBI's alert of 26 February 2025.

Each theft is four to five times the last. Two of the three, DMM Bitcoin and Binance, ran through a fake recruiter. For the rest of this year's crypto losses, see our Q3 2026 review.

The attacker's playbook

The execution chain for each door, with MITRE ATT&CK techniques. Where a technique is our nearest match rather than the source's own label, we say so.

Door 1, the fake recruiter

Choose the target from public profiles that name the employer and the role (T1593.001, Search Open Websites/Domains: Social Media). At Binance, a June compromise had already told the attacker who worked on wallets.
Build a fake company and recruiter on legitimate job sites and LinkedIn (T1585.001, Establish Accounts: Social Media Accounts), complete with an "HR" interviewer, a "CEO" and personal social-media content.
Make contact through the platform's messages (T1566.003, Spearphishing via Service).
Get the target to run the code: an assignment repo, a pre-employment test or a "fix" for a video call (T1204.002, User Execution: Malicious File). A tampered installer found through a web search did the same job in Binance's June stage (nearest match: T1608.006, SEO Poisoning).
Take the session, then the system: stolen session cookies at Ginco (T1539, Steal Web Session Cookie); deployment credentials and an internal AI tool at Binance (T1078, Valid Accounts).
Move the money through signing systems and launder it quickly (T1657, Financial Theft).

Door 2, the fake applicant

Borrow or steal an identity and write a convincing CV with language models (T1656, Impersonation).
Get through interviews with help: a coach feeding answers, a face swap for a few minutes, then "network problems".
Have the laptop sent to an enabler and run it from abroad through KVM switches or remote-access tools (T1219, Remote Access Tools).
Work, get paid, and keep the access: salaries to an enabler's account, with insider access to code and data (T1078, Valid Accounts). When exposed, some extort (T1657, Financial Theft).

What does not change, whatever the next disguise: the recruiter needs the target to run code on a machine that matters, and the applicant needs the company to accept someone it has never verified live. Close those two conditions and the disguise stops mattering.

The defender's playbook

Figure 7. Original graphic. Every flag comes from a case or an advisory named in brackets.

Figure 8. Original graphic. No single team can close either door alone.

For every employee

Treat any request to run code, install a tool or "fix" a meeting app during a job process as an attack. Do the tests, if at all, on a personal device you can wipe, never on a work machine.
Report odd job approaches. Make it blame-free: an engineer looking for a new job is normal, and the report is what lets security warn colleagues.
Keep sensitive duties off public profiles. Binance's attacker learned who worked on wallets from its June foothold; others learn it from profiles.

For HR and hiring managers

Keep the camera on for the whole interview, and ask live questions that need no preparation: the neighbourhood, the weather, the nearest station. Vary them, as Kraken advises.
Check identity live: the ID against the face on camera, the phone number, and whether the applicant's internet address matches where they say they live, as the NPA recommends.
Meet in person for roles near money, keys or production systems. The 31 July alert asks platforms to require it; companies can too.
Share intelligence. Kraken was tipped off by peers' lists of suspect emails. Join the industry channels you have, and contribute to them.

For IT and security

Make developer machines boring targets: EDR everywhere, allow-lists for installers and packages, and no admin rights by default. Binance's June stage began with an installer found through a web search.
Keep signing and production systems out of reach of ordinary laptops. Use separate hardened devices, short-lived credentials and two-person approval for large transfers. Give internal AI tools only the privileges their users need, because at Binance one became a stepping stone.
Watch new hires' devices: remote-access tools, KVM-over-IP devices, and VPN logins from places the employee does not live.

For finance and legal

Pay only into accounts in the employee's own name, in the currency of their contract, never in crypto.
Know the legal exposure. The NPA warns that paying North Korean IT workers can breach Japanese law and sanctions, even unknowingly; report suspicions to the police promptly.

Copy-paste templates

Note to all staff

Subject: Job offers that ask you to run code

North Korean operatives are posing as recruiters on LinkedIn and job sites.
At Binance, an "interview assignment" run on a work computer was one step
in an attack that took about $6.3 billion in October 2026.

- Never run a coding test, repo, installer or "meeting fix" from a recruiter
  on a work device. If you must do a test, use a personal device you can wipe.
- If a recruiter, "HR" contact or "CEO" asks you to install or run anything,
  stop and report it to [security contact]. You will not be in trouble for
  looking for a job.
- Do not list wallet, signing or production duties on public profiles.

Thank you.

Interview identity checks for hiring managers

INTERVIEW IDENTITY CHECKS – REMOTE ROLES
Candidate:                     Role:                    Interviewer / date:

[ ] Camera on for the whole interview; name on screen matches the CV
[ ] Only one voice; no signs of coaching or a second screen
[ ] Two or three live, unscripted local questions (vary them each time)
[ ] Government ID shown on camera and matched to the face
[ ] Phone number called and answered by the candidate
[ ] Connection location consistent with stated home (security to check)
[ ] Email / GitHub checked against shared lists of suspect identities
[ ] In-person meeting arranged for roles near money, keys or production
[ ] Laptop to a verified home address only; pay to an account in their own name
[ ] Anything odd reported to security before an offer is made

What remains unknown

How Binance's stages connect. Binance's first update pointed to one DevOps laptop; later updates found more points of breach. It says the investigation continues and will be reviewed independently.
Which campaign reached Engineer B. Binance describes the fake interview but has not tied it to a named campaign.
Who Kraken's applicant was, and whether the same identity was hired elsewhere.
How many Japanese companies have unknowingly hired North Korean IT workers. The NPA has described one laptop farm; it has not given a count of employers.
Who the Japanese exchange was. The NPA does not name it.

Sources and updates

Published 4 November 2026 (JST). Our research network blocks direct access to most of these sites. We therefore read Binance's updates on X, Kraken's blog post, the FBI's alerts, the NPA's and MOFA's pages and the Justice Department's releases through search-engine extracts of those pages, and we quote only what those extracts showed. The WaterPlum figures also match the joint advisory as we read it directly for our earlier analysis of the four state actors. Binance's $6.34 billion is its own estimate; the FBI says "more than $6 billion". Binance's 27 October statement is cited through Wu Blockchain's relay because we could not find Binance's own post.

North Korea on both sides of the interview: the fake recruiter behind the $6.3 billion Binance theft, and the fake applicants at Kraken and in Japan

30-second briefing