Fireblocks Unmasks North Korea-Linked Recruitment Scam

## Fireblocks Thwarts Sophisticated North Korean Cyberattack Targeting Crypto Talent

**New York, NY** – Digital asset infrastructure firm Fireblocks has successfully disrupted a sophisticated phishing campaign orchestrated by North Korea-linked hackers, aimed at compromising cryptocurrency talent through fraudulent job recruitment. The attackers employed a highly convincing impersonation scheme, leveraging fake job interviews and technical assignments to gain access to sensitive digital assets and infrastructure.

The operation, detailed by Fireblocks CEO Michael Shaulov, involved hackers meticulously mimicking a legitimate Fireblocks hiring process. Candidates were lured into what appeared to be standard interview procedures, including Google Meet calls and GitHub-hosted coding assignments. However, unbeknownst to the applicants, running a routine installation during these assignments would deploy malware, creating a backdoor to potentially expose private keys, digital wallets, and production systems.

“What they’re basically doing is weaponizing a legitimate interview process to create a very authentic interaction with candidates,” Shaulov explained in an interview. The hackers specifically targeted engineers identified through platforms like LinkedIn, seeking individuals with “privileged access” to critical systems. Fireblocks identified nearly a dozen continuously evolving fake profiles, suggesting the scam has been active for several years.

“We were able to interact with the hackers and collect ‘indicators of compromise’ – essentially the digital fingerprints of the tools, weaponry, and malware they were using,” Shaulov noted. Fireblocks collaborated with LinkedIn and law enforcement agencies to identify and remove these fraudulent accounts.

A LinkedIn spokesperson stated, “Over 99% of the fake accounts we remove are detected proactively before anyone reports them.” The professional networking platform emphasized its ongoing investment in technology to combat malicious activity and highlighted existing safeguards, such as in-message warnings for off-platform communication and verification badges for recruiters.

This incident underscores the escalating sophistication of cyber threats within the digital asset space. It follows a pattern of high-profile attacks linked to North Korea, most notably the staggering $1.5 billion heist from crypto exchange Bybit last year. Analysts at Elliptic, a blockchain analysis firm, attributed that attack to the Lazarus Group, a state-sponsored hacking collective notorious for its extensive crypto operations.

Shaulov, who previously investigated Lazarus Group’s 2017 attacks on crypto platforms, observed a dramatic evolution in their tactics. “It was actually quite easy” to identify them in the past due to linguistic errors, he recalled. “But now, it looks like they graduated from Oxford.” This heightened professionalism, he believes, is partly fueled by the increasing integration of artificial intelligence in cyberattack methodologies.

“It’s clear that the attackers have become way more sophisticated and way harder to detect because of AI,” Shaulov concluded. The successful disruption by Fireblocks serves as a critical reminder for companies operating in the digital asset ecosystem to remain vigilant and continuously enhance their cybersecurity defenses against increasingly advanced threats.