A crypto exchange raises $100 million. It hires remote. It ships fast. It keeps user funds in a hot wallet with two signers and calls it operational efficiency. This week, according to a media report citing a single unnamed source, an American company discovered that the IT contractor it onboarded — the one who cleared the coding screen and the culture fit — was not the person on the résumé. The résumé belonged to a third-country national. The seat, once occupied, was handed to a North Korean operative.
That is the entire report. Three facts, no attribution, no names, no timeline. I sat with it longer than the text deserved. Silence is the first red flag. The sentence I keep returning to is not the infiltration. It is the handoff. One applicant passes the interview; a different person takes the chair. The employer never notices the seam.
That seam is the whole story. And every crypto protocol in this cycle has welded it shut on-chain while leaving it wide open at the door.
Context
North Korea's IT worker scheme is not new. It is documented, sanctioned, and still running. The pattern is stable: DPRK nationals, or third-country proxies, obtain remote employment at foreign firms — software, design, engineering, sometimes compliance — and route the salary home. The U.S. Treasury has sanctioned the networks that facilitate it. The FBI has issued warnings. The scheme persists because the economics work, and the economics are boring enough that nobody builds a narrative around them.
A mid-level remote engineer at a Western crypto firm earns $150,000 to $250,000 a year. Several hundred of those salaries, consolidated, is real money — hard currency that survives SWIFT exclusion because it never touches a bank that checks nationality. Incentives align, or they break. Here they align perfectly. The employer wants cheap, fast, always-on labor. The worker wants dollars. The state wants both the dollars and the access. Three parties, one contract, no conflicts.
Crypto firms are the ideal host. If the report's target had been a hospital or a freight company, the item would be smaller. Crypto is remote by default, pseudonymous by ideology, and saturated with capital that is concentrated, liquid, and uninsured. A bank can absorb a data breach. A DeFi protocol cannot absorb a compromised deployer key. The industry built a culture that treats anonymity as a feature and then hired into it at scale.
I have watched this vector mature for nine years. In 2017 I was reverse-engineering token distribution schedules in Python, hunting centralization that a whitepaper had buried. In 2020 I was simulating liquidation cascades because the interest-rate models only held in calm markets. In 2022 I rebuilt the Terra death spiral locally to prove the peg was arithmetically dead. Every one of those audits looked at the code. None of them asked who was committing to it. That was a blind spot. It is now the whole map.
Core
Start with the mechanics, because the mechanics are where the fear usually stops and the analysis begins.
Two roles, one chair. The front end is a third-country national with a plausible identity — a real visa, a clean LinkedIn, references that answer the phone. That person sits the interview. The back end is a DPRK operative who assumes the account: the email, the Slack handle, the GitHub history, the daily standup. If the handoff is executed well, the employer never sees a discontinuity, only a quiet decline in camera-on frequency and a plausible reason for it.
The crypto-specific exposure is not the salary. It is the repository.
Consider what a remote hire at a crypto firm actually touches within ninety days. The smart contract repo, including pending audits and unreleased deployments. The deployer wallet and its seed phrase, frequently pasted into an internal doc that "only the team" can open. The treasury multisig, often 3-of-5 or 2-of-3, where the new hire is added as a signer "for redundancy." The exchange API keys. The internal wiki that quietly maps where the keys live.
None of that requires exotic malware. It requires a badge, an SSO login, and patience. The ledger lies; the code tells — but the code was never the breach point. The breach point is that a human sat in front of the code, holding the keys, and the human was not who the payroll system believed.
Based on my audit work, key material is almost never where the team says it is. It sits in a private repo three engineers can read, or a Notion page with a shared link, or a screenshot in a Telegram thread from six months ago. When I stress-test a protocol, I do not begin at the smart contract. I begin at the access map. The contract is usually fine. The access map is usually a disaster.
The on-chain evidence, when it finally appears, appears late. In the 2022 Ronin Bridge exploit, North Korea's Lazarus Group opened with a fake job offer to a Sky Mavis engineer — spear-phishing, not a contract bug. The $625 million that left Ronin afterward was not extracted by cryptography. It was moved by five compromised validator keys held by people who had been approached as people. The code executed exactly as written. The victims were upstream of the code.
That is the pattern. The exploit is downstream. The recruitment is upstream. Analysts spend careers reading the downstream transaction graph and never once open the job posting that started it. History is just data waiting to be read — and the first data point is the hiring ad.
Track the money. When DPRK IT worker salaries consolidate, they flow into crypto. Sanctions actions and public analyses have shown these funds moving through mixers, chain-hopping bridges, and over-the-counter desks — the same rails used by the DPRK's outright theft operations, from Harmony to Bybit. The state does not distinguish between stealing crypto and being paid in it. Both convert to the same hard currency on the other side. Volume is noise; intent is signal. The intent is foreign exchange, plus access, plus optionality.
The third function is the one nobody prices. Each successful placement does not merely earn a salary. It launders a proven identity. That identity can be reused across other employers, other chains, other payroll systems. The scheme compounds. One clean hire becomes ten clean hires becomes a network the employer cannot see, because the employer is only checking a résumé, not the résumé's position inside a graph.
Here is where crypto is worse than traditional finance, and it is worth being blunt. A bank fails a background check and the applicant disappears. A crypto protocol fails a background check and the applicant is already a multisig signer, because the firm "needed a third signer fast" and the candidate was "clearly senior." Speed is the enemy of verification. This cycle is all speed.
There is a second structural gap worth naming. Attribution. When a DPRK hire is eventually discovered, the trail points at a third-country passport, a VPN exit node, and a laptop that has been wiped. The state that benefited is the hardest party to name. This is not an accident. It is the design. The front-end identity exists to absorb blame the way a shield absorbs a blow. By the time the employer knows it was infiltrated, the paperwork points somewhere that is not Pyongyang.
The routing is engineered with the same care. Salaries do not arrive in one account. They are split, converted, and layered — fiat into stablecoins, stablecoins across bridges, bridges into OTC desks that settle in cash or in crypto that never touches a compliant exchange. The friction is deliberately placed where a compliance officer would look, then routed around it.
Contrast that discipline with the audit layer. A protocol will pay six figures for a firm to read its Solidity. It will pay almost nothing to verify that the engineer requesting deployer access is a real person with a real history. The budget tells you what the team believes the risk is. The budget is wrong.
Contrarian
The consensus in crypto security says the industry is hardening — more audits, more hardware wallets, more multisig, more monitoring. That is true. It is also precisely why the attack is moving.
When the technical surface gets expensive to breach, adversarial economics shift to the cheapest entry point. That entry point is a person who wants a job. You can measure a protocol's defenses by where the friction sits — and in most crypto firms, the friction sits at the smart contract layer and almost nowhere at the hiring layer.
The bulls will answer, correctly, that on-chain transparency is an advantage. Stolen funds are traceable, exchanges can freeze, the public can follow. True, and largely irrelevant here. By the time tracing starts, the keys are gone and the operator has been inside for a year. Detection is not prevention. Transparency records a wound; it does not stop the knife.
The deeper correction to the bull case is this: the industry spent a decade engineering trustlessness into its code while quietly rebuilding trust into its org charts. Every "we only hire people we trust" is a single point of failure with an email address. The technical sophistication of a protocol tells you nothing about whether the person holding the deployer key is who they claim to be. Algorithmic truth requires no defense. Human truth requires all of it, and receives almost none.
There is one thing the skeptics get wrong, too. They frame this as state-sponsored espionage — exotic, geopolitical, somebody else's problem. It is not. Strip the flag away and it is the ordinary risk of hiring remote, unverified labor into a role with money-adjacent access, a risk every startup underwrites for speed. North Korea did not hack a culture. It read one and moved in. Gravity does not negotiate with the company that skipped the check.
Takeaway
The next billion-dollar crypto loss will not be a reentrancy bug. It will be a bad hire, and the post-mortem will live in an HR folder, not a contracts repo. The tools to stop it already exist — verified identity, custody separation, the discipline to never let one person hold both the interview and the keys. The industry that shipped multisig can ship a background check.
Until it does, every protocol runs unhedged — not against the market, but against the person who passed the interview.