Crypto: North Korea Uses Foreign Recruits to Infiltrate U.S. Companies

North Korea is expanding its infiltration system of American companies. According to an NBC investigation, IT workers based notably in Iran and Lebanon are recruited to attend interviews on behalf of North Korean operators. Some reportedly received 500 dollars per month in crypto to play the “interview associates” role. Once the contract is secured, the position can be taken over by a worker linked to Pyongyang. American authorities had already documented the increasing use of third parties to bypass recruitment controls.

Crypto: 500 dollars per month to attend interviews

The process adds another layer to the fake profiles already used by Pyongyang. NBC reports that foreign IT workers were approached on LinkedIn. Their mission: to appear at interviews for remote jobs in American companies. Some were reportedly offered about 500 dollars monthly in cryptocurrencies for this part-time work. Once hired, accesses can then be used by North Korean operators.

This mechanism resembles the one that allowed a developer linked to North Korea to infiltrate Consensys teams. The company discovered in July that a consultant using the identity “Tyler Knapp” worked for about a month on some of its systems.

The NBC report brings a new element: Pyongyang no longer depends solely on its own operators and fake identities. It can also use a real person located in a third country to succeed in the most difficult part of recruitment.

The international alert published on July 31 by the United States and several governments confirms this evolution. It indicates that North Korean workers increasingly use third parties to create accounts, participate in interviews, and even meet physically with an employer to establish a trust relationship.

The document does not mention the 500 dollars payment nor the Iranian and Lebanese cases. These details come from the NBC investigation.

Fake employees are already a major problem for the crypto industry

The method is not only used to earn a salary. The July 31 alert warns that these workers can become an internal threat: data extraction, theft of sensitive information, and crypto theft are directly among the identified risks. Targeted jobs also include software development, mobile applications, and blockchain applications.

The Ethereum Foundation already knows the problem. In April, Cointribune reported that it had helped identify about 100 workers linked to North Korea in 53 crypto projects.

CrowdStrike gives an idea of the amount at stake. Its 2026 report on financial threats attributes 2.02 billion dollars in digital asset thefts in 2025 to actors linked to North Korea, 51% more than in 2024. The PRESSURE CHOLLIMA group is notably associated with a 1.46 billion dollar theft. Other North Korean groups have used fake recruiters, AI-generated identities, and synthetic videoconference environments.

Chainalysis arrives at the same amount: 2.02 billion dollars stolen in 2025, for an estimated total of 6.75 billion dollars attributed to North Korean hackers over the years. This strategy sometimes completely avoids traditional hacking. No need to find a flaw in a smart contract if the operator directly obtains a developer position and internal access. This increasingly worries crypto companies.

Washington now targets the entire recruitment infrastructure

The United States also pursues those who make these infiltrations possible. In March, the US Treasury sanctioned six individuals and two entities for their participation in North Korean IT worker networks. OFAC estimates that these schemes generated nearly 800 million dollars in 2024 to finance notably Pyongyang’s weapons of mass destruction programs.

The Department of Justice also documented the “laptop farms.” In one case, two US citizens helped North Korean workers pass as employees based in the United States. The system used the stolen identities of at least 80 people and secured jobs at more than 100 American companies. Over 5 million dollars were reportedly generated for the North Korean regime.

The professional computers were physically kept in the United States. North Korean operators then accessed them remotely, giving the employer the impression that their developer was working from the country.

The international alert now recommends stricter controls: thorough document verification, in-person interviews when possible, monitoring frequent changes of identity or bank details, and particular attention to candidates using unusual payment methods. North Korean workers can notably request their salary via transfer services or in crypto.

The sector already knows the threat. In 2025, CZ warned about 60 fake North Korean developers identified in the crypto ecosystem. The novelty is elsewhere: fake profiles can now have a real face during the interview. A recruiter can thus check the camera, talk with the candidate, and think they have confirmed their identity. The worker who connects a few days later may be someone else. For American companies and crypto exchanges, remote recruitment thus becomes a full-fledged attack surface.