A North Korean agent applied for a job at a popular crypto firm: They tripped...

[ABCbits]

A North Korean agent applied for a job at a popular crypto firm: They tripped him up with a simple question about Halloween

The hiring team at Kraken, a U.S-based crypto exchange, noticed immediately that something was off about “Steven Smith,” a would-be IT worker who applied for a software engineering job in early October. But it wasn’t until they compared Smith’s email to a list of those suspected to be part of a hacker group that their suspicions were confirmed: Smith was a North Korean operative... Read more here.


It's good to see Kraken perform detailed check. And for those who're being skeptical, Kraken also share about this matter on https://blog.kraken.com/news/how-we-identified-a-north-korean-hacker and https://www.youtube.com/watch?v=2vXHlnjKbBI.  Your opinion is greatly appreciated.

[Crwth]

Wow, so maybe the hacking is with people on the inside, and I think that explains all that with the recent hacks and how they were able to breach security. I hope that a lot of centralized exchanges will vet their possible employees.

Thank you for sharing this op. I didn't know it was like this.

[bitterguy28]

this could be the exact method of north koreans infiltrating various crypto exchanges and knowing all about the ins and the outs and when and where they could be vulnerable enougn to attack

i just find it weird how unprepared this supposedly north korean agent is, surely they do not operate this sloppy and they would at least come up with better proof of their identity

[ABCbits]

i just find it weird how unprepared this supposedly north korean agent is, surely they do not operate this sloppy and they would at least come up with better proof of their identity

Yeah, i would speculate those agents haven't been trained against company who become aware of their infiltration attempt. Although it's possible that they assume some of the question (about culture of where they claimed to live) is part of casual or icebreaker discussion.

[Bobcrypto]

A North Korean agent applied for a job at a popular crypto firm: They tripped him up with a simple question about Halloween

The hiring team at Kraken, a U.S-based crypto exchange, noticed immediately that something was off about “Steven Smith,” a would-be IT worker who applied for a software engineering job in early October. But it wasn’t until they compared Smith’s email to a list of those suspected to be part of a hacker group that their suspicions were confirmed: Smith was a North Korean operative... Read more here.


It's good to see Kraken perform detailed check. And for those who're being skeptical, Kraken also share about this matter on https://blog.kraken.com/news/how-we-identified-a-north-korean-hacker and https://www.youtube.com/watch?v=2vXHlnjKbBI.  Your opinion is greatly appreciated.

Hackers this days apply several new strategies to succeed on their illegal operations, I won't be  surprised that this could be some of their methods, it is wake up call for all exchanges to be vigilant especially during recruitment seasions.
I think is appropriate to use more stronger means in conducting interview especially when employing foreigners. Some of the questions or inquiries about candidates nationality should be added on jobs interviews in my opinion.

[TomPluz]

I am sure that Steven Smith (or whatever his real name is) now learned a very important lesson on cultural things before trying to infiltrate a well-known crypto-based firm. Good to see Kraken publishing this story which can be serving as a warning to other organizations to be careful and vet well the people they are taking in to be a part of the ranks. Imagine the idea of trusting and paying someone to be your employee and that employee has the intention of doing some social engineering that can be used later for some hacking purposes....this what may happen if Steven Smith passed the test initiated by Kraken. I am looking for a movie to be made based on this story.

[Lucius]

This is such a strange story to me, because if it's about a foreign agent trying to infiltrate some company, then it makes no sense to me that he would come to the interview completely unprepared. It makes no sense at all that he claims to live in city A, and then shows documents that actually show an address 300 miles away from where he lives.

Besides, what kind of secret agent is he who uses an e-mail address that is on the blacklist of NK hackers to apply for a job? If NK secret agents are so unintelligent, I wonder how they even manage to hack anyone...

[SPOON_MOJO]

Credit to Kraken for detecting that early and not letting it pass. It illustrates how severe the issue is getting in the crypto industry especially with bad actors from state supported entities. The fact that something as simple as a Halloween inquiry helped expose it is wild but also somewhat smart. Firms definitely need to be smart like this more than ever now

[target]

This is such a strange story to me, because if it's about a foreign agent trying to infiltrate some company, then it makes no sense to me that he would come to the interview completely unprepared. It makes no sense at all that he claims to live in city A, and then shows documents that actually show an address 300 miles away from where he lives.

Besides, what kind of secret agent is he who uses an e-mail address that is on the blacklist of NK hackers to apply for a job? If NK secret agents are so unintelligent, I wonder how they even manage to hack anyone...

Exactly. Spy agents are pretty clever which they spend years in trying to learn to get around the city which they would know every thing. They assume to be a local person in the city, they know how a lie would sound. Like a military guy, they know when a person lie. A spy will qualify to be a spy if he is clever enough, that Smith isn't qualified to be one which I think he may really just be a South Korean just wanting to get a job.

[tabas]

This is what they have probably been doing for a long time to have some idea through agents on how they can exploit these exchanges or crypto projects detailed security. It's good that kraken did a thorough background check and I think it's not only these crypto exchanges that needs to be aware of it. But also in the banking and other financial companies that are banking millions to billions of dollars. They could study well if there are loopholes through their system and security.

[digaran]

Don't know why they call them "hackers", usually the hacking happens to avoid getting caught during the interview or at least that's what we see in the movies. Lol

There is something wrong with the "Smith" name, it's the first go to last name for anyone trying to forge a fake identity online, they should know better. I wonder how many of these amateur agents are currently at work in different places!

[ABCbits]

I am sure that Steven Smith (or whatever his real name is) now learned a very important lesson on cultural things before trying to infiltrate a well-known crypto-based firm.

If he actually work on NK government agency for inflation purpose, he surely allocated to different field or even meet worse fate. So he learned about it too late.

This is such a strange story to me, because if it's about a foreign agent trying to infiltrate some company, then it makes no sense to me that he would come to the interview completely unprepared. It makes no sense at all that he claims to live in city A, and then shows documents that actually show an address 300 miles away from where he lives.

Besides, what kind of secret agent is he who uses an e-mail address that is on the blacklist of NK hackers to apply for a job? If NK secret agents are so unintelligent, I wonder how they even manage to hack anyone...

Exactly. Spy agents are pretty clever which they spend years in trying to learn to get around the city which they would know every thing. They assume to be a local person in the city, they know how a lie would sound. Like a military guy, they know when a person lie. A spy will qualify to be a spy if he is clever enough, that Smith isn't qualified to be one which I think he may really just be a South Korean just wanting to get a job.

I agree this spy isn't skilled enough. But i seriously doubt average job seeker would show all red flags mentioned on Kraken blog.

[Lucius]

~snip~
I agree this spy isn't skilled enough. But i seriously doubt average job seeker would show all red flags mentioned on Kraken blog.

I would go a step further and conclude that this is a complete amateur who has nothing to do with espionage, and it is even possible that this is a PR story that was invented in order to show that this CEX has high standards when hiring people, and therefore their level of security is at a high level. Either way, something's not right about this story.