What happened
Crypto. News reported Thursday that North Korean operatives are now routinely passing full technical interviews at crypto companies, getting hired as remote engineers, and then using the standard access that comes with the job - repos, signing keys, cloud credentials, treasury tooling - to move funds or stage later theft. The report ties the pattern to a string of recent US Department of Justice actions and private incident response work, in which developers hired through normal channels later turned out to be sanctioned individuals or fronts for sanctioned groups.
These aren't phishing lures or spoofed LinkedIn profiles caught at the gate. They're paid employees, with git history, pull request reviews, and standups, often for months before anyone gets suspicious. The route is deliberate: ship useful code, build reputation, then weaponize the trust.
Prosecutors and security investigators cited in the piece describe operatives using US-based 'laptop farm' facilitators to defeat IP and hardware checks, and splitting salaries across mixers and OTC desks to hide the flow back to Pyongyang.
Why it matters
The crypto sector has spent two years hardening smart contracts, bridges and custody. Attackers responded by walking in the front door. A remote engineer with repo write access and a seat in the on-call rotation doesn't need to break anything.
They already have the keys. For firms running lean, the hiring pipeline is now a security perimeter, and most of them don't staff it like one. The economics are brutal for the defender.
An external exploit needs a bug. An inside hire needs patience. North Korea has patience.