How to Spot North Korean IT Workers in Crypto Hiring

Video transcript

North Korean IT workers take remote crypto jobs under false identities. Catch them by looking for mismatches, not nationality.

Beyond salaries, the DOJ alleges workers in one case stole over nine hundred thousand dollars in crypto after being hired.

Start with the paper trail: identity details that differ across resume, GitHub and LinkedIn, contacts reused across applicants, and claimed experience missing from GitHub. One flag proves nothing, so look for several.

On video, watch for repeated camera problems, a voice that switches as if coached, trouble with questions about their own city, and signs of face-swapping.

For access to code, keys or funds, check a physical ID on camera and vary your questions. Ship laptops only to the ID address, and pay only a bank account in their verified name.

Checks continue after the offer. Watch for laptop farm tools, logins from several countries, requests for crypto pay, and repos copied to personal accounts.

Limit the blast radius. SEAL says never make a remote employee a multisig signer, and in most of its cases it finds more North Korean workers in the same organization.

If you suspect one, act through a small trusted group. Stop payments, revoke access, review their code changes, and report it to the FBI.

Guardian's OpSec Audit shows where one hire could reach your keys. Read the full checklist, or talk to Guardian.

North Korea has sent thousands of IT workers abroad, according to a May 2022 advisory from the US State Department, Treasury and FBI. The advisory says their pay helps fund its weapons programs.

Many pose as remote workers from other countries, using false or stolen identities. The advisory says they "often take on projects that involve virtual currency."

This checklist turns US government red flags into steps for founders, HR and security. It looks for mismatches, not nationalities.

Why Crypto Is Targeted

Remote, global hiring suits the scheme. The risk goes beyond salaries:

The theft case is crypto-specific. The DOJ charged four North Koreans and alleges two of them used false identity documents to get jobs.

The employers were a blockchain research and development company in Atlanta and a virtual token company in Serbia.

One defendant allegedly took about $740,000 by modifying smart contract source code. The funds allegedly went through Tornado Cash and exchange accounts opened with fake IDs.

The charges are allegations.

Application Red Flags

Check the paper trail before anyone gets an interview:

• Name, location, education or work history differs across resume, GitHub, LinkedIn and payment profiles (2022 advisory).
• Phone numbers, especially VoIP numbers, or emails reused across applicants (FBI).
• Resume content identical to another applicant's (FBI).
• Claimed experience that does not show up on GitHub (SEAL).
• A surprisingly simple portfolio site or profile (2022 advisory).
• Little digital footprint, or accounts very similar to other people's (Microsoft).
• Candidates from a staffing firm whose hiring checks you have not audited (FBI).

Microsoft says AI now polishes resumes, so writing quality proves little either way.

One flag proves nothing. Look for several together, and run the same checks on every candidate.

Interview Red Flags

The advisory says these workers favor "text-based chat instead of video calls." When video is unavoidable, watch for:

• Repeated camera or microphone problems that block the interview (Microsoft).
• A name on the call that differs from the resume, then quickly changes (Kraken).
• A voice that switches, as if someone is coaching in real time (Kraken).
• Trouble with simple questions about the city they claim to live in (FBI, Kraken).
• Background noise, as if others nearby are doing similar work (FBI).
• Signs of AI or face-swapping on video (FBI).

Kraken wrote in May 2025 that an industry tip and its own checks identified one applicant as a North Korean hacker. It kept interviewing them to study the approach.

In the final round, Kraken asked for a government ID on camera and local restaurant tips. The candidate struggled.

Verification Steps

Run these checks for every remote hire with access to code, keys or funds.

1. Have the candidate hold the physical ID up to the camera. Do not accept scans.
2. See them on camera in more than one session, and keep records of interviews.
3. Ask live questions about their claimed city, and vary them between interviews.
4. Verify past employers and schools using contacts you find yourself.
5. Run a background check, and E-Verify for US hires.
6. Ship the laptop only to the address on the ID.
7. Pay only into a bank account in the verified name. Avoid paying in crypto.
8. Repeat identity checks at onboarding and during employment.
9. Complete as much of hiring and onboarding in person as you can.

The steps come from the 2022 advisory, FBI alerts from 2024 and 2025, Microsoft, SEAL and Kraken. Kraken's advice: "Try to avoid patterns in the types of verification questions that hiring managers use."

After Hiring

Checks do not end at the offer. These signals can surface weeks later:

Laptop farms

In a laptop farm, a facilitator keeps company laptops at home and connects them to KVM switches. Workers abroad control them remotely, so employers think the work is done in the US.

On June 30, 2025, the DOJ announced actions across 16 states, including searches of 29 known or suspected laptop farms. It reported seizing about 200 computers.

One indictment alleges a scheme used the identities of more than 80 US persons to get jobs at more than 100 US companies.

Limit the blast radius

SEAL's rules for remote hires:

• Never make a remote employee a multisig signer.
• No publishing rights on package managers.
• No unlimited access to cloud instances.
• Name a lead developer you have met in person, and silo remote staff from critical systems.

SEAL also says that in the majority of its cases, it finds more North Korean IT workers in the same organization.

If you suspect one, work through a small trusted group so you do not tip them off, as Microsoft advises. Then follow SEAL: stop payments, revoke access, and review their code changes, especially dependencies and CI/CD files.

Report it to the FBI at IC3.gov. For the wider program, see our insider threat template.

How Guardian Helps

Guardian's OpSec Audit covers people and response: who approves what, how joiners and leavers are handled, and which single points of failure need spreading.

It also reviews access across every system, secrets handling and release control, to show where one hire's access could reach your keys.

Managed Security covers nine operational security domains and 118 controls. Its security operations team also reviews every multisig transaction before signing.

Your developers face the reverse lure: see fake job interviews and coding tests, and our crypto OpSec baseline.

Frequently Asked Questions

What are DPRK IT workers?

North Korean nationals who take remote tech jobs under false or stolen identities to fund the regime, the US government says. The FBI warned in January 2025 that some steal code and demand ransom once found out.

What is a laptop farm?

A home where a facilitator keeps company laptops and lets workers abroad control them remotely, so the employer thinks the work is done locally. The DOJ says facilitators connected the laptops to KVM switches.

Can a deepfake pass a video interview?

The FBI says North Korean IT workers have used AI and face-swapping in video interviews. Ask the candidate to hold the physical ID up to the camera, repeat video checks, and onboard in person where you can.

What should I do if I think I hired one?

Handle it through a small trusted group, as Microsoft advises. SEAL says to stop payments, revoke access and review their code changes, especially dependencies and CI/CD files. Report it to the FBI at IC3.gov.

Sources

• US Department of State, Department of the Treasury and FBI: Guidance on the Democratic People's Republic of Korea Information Technology Workers (May 16, 2022)
• US Treasury: Fact Sheet, Guidance on the DPRK Information Technology Workers (May 16, 2022)
• FBI (IC3): Democratic People's Republic of Korea Leverages U.S.-Based Individuals to Defraud U.S. Businesses and Generate Revenue (May 16, 2024)
• FBI (IC3): North Korean IT Workers Conducting Data Extortion (January 23, 2025)
• US Department of Justice: Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers' Illicit Revenue Generation Schemes (June 30, 2025)
• Microsoft Threat Intelligence: Jasper Sleet, North Korean remote IT workers' evolving tactics to infiltrate organizations (June 30, 2025)
• Kraken: How we identified a North Korean hacker who tried to get a job at Kraken (May 1, 2025)
• SEAL Frameworks: Mitigating DPRK IT Worker Threats
• Guardian: OpSec Audit
• Guardian: Managed Security