DPRK Hackers Perfected Their Fake Interview Playbook Over Dozens of Attacks Before Binance

Chainalysis investigators have followed this strategy for years. It takes many forms; in the Binance case, for example, DPRK workers lured their targets into applying for a phony job and infected their computer with malware instead. But in other instances the attackers are themselves the applicants, either working under false pretenses to generate money for the regime, infecting corporate systems, or both. Each instance can leave an on-chain footprint. Over the past 18 months, Chainalysis has attributed more than $14.3 million in losses to similar DPRK-linked fake interview and malware schemes.