The cryptocurrency industry is once again facing a chilling reminder of its vulnerabilities. Changpeng Zhao, widely known as CZ, co-founder of Binance, has issued a stark warning after a group of ethical hackers uncovered at least 60 fake IT worker profiles linked to North Korea.

ALSO READ : Dutch firm Amdax raises $23M to chase 1% of Bitcoin supply what it means for global markets

In a post on X (formerly Twitter), CZ cautioned crypto firms that North Korean operatives are disguising themselves as developers and IT specialists to secure jobs within exchanges. Once inside, they attempt to steal sensitive user data, inject malicious code, or even bribe staff.

They pose as job candidates to try to get jobs in your company. This gives them a foot in the door, especially for development, security, and finance roles,” CZ wrote.

He further explained how some impersonators pretend to be employers, tricking staff during fake interviews by sending links disguised as “software updates” — malware designed to hijack their devices.

Coinbase also on high alert

This warning echoes similar concerns raised recently by Brian Armstrong, CEO of Coinbase. Armstrong confirmed last month that his company had implemented stricter hiring and security policies after spotting a surge of malicious attempts from North Korean actors.

Among these measures: requiring employees with access to critical systems to be U.S. citizens, mandatory fingerprinting, and in-person training sessions. “It feels like there’s 500 new people graduating every quarter from some kind of school, and that’s their whole job,” Armstrong said during a podcast with John Collins.

Security Alliance SEAL team investigation

The revelations surfaced thanks to the efforts of the Security Alliance (SEAL), a white-hat hacker collective led by Paradigm researcher Samczsun. The group compiled a repository exposing dozens of North Korean operatives, complete with their fake names, email addresses, forged IDs, GitHub profiles, and even companies that unknowingly hired them.

In June, at least four such operatives successfully infiltrated multiple startups, siphoning nearly $900,000 in funds before being detected. SEAL has conducted more than 900 investigations since launching in 2023, underscoring the growing importance of independent ethical hacking groups in safeguarding the blockchain ecosystem.

The Lazarus Group connection

Experts point to the infamous Lazarus Group — a North Korean state-sponsored hacking collective — as being behind many of these operations. The group is suspected of orchestrating the $1.4 billion Bybit hack, the largest crypto heist in history.

According to Chainalysis, North Korean cybercriminals stole more than $1.34 billion worth of digital assets across 47 incidents in 2024, a staggering 102% increase from 2023’s $660 million.

What companies should do

CZ urged all crypto platforms to step up employee training and candidate screening. “Train your employees to not download files, and screen your candidates carefully,” he advised.

Industry analysts believe that as regulation tightens and exchanges invest more in compliance, North Korean hackers are shifting their tactics from direct theft to insider infiltration. The fight, they say, will require close collaboration between exchanges, governments, and security researchers.

For now, the message is clear: hiring in the crypto space is no longer just an HR issue — it’s a frontline battle against state-backed cybercrime.