A fake job offer opened the door to a suspected North Korean crypto hack

While many companies rely on blockchain technologies to protect their systems, social engineering – that is, manipulating people – remains a major vulnerability. — Photo by Kanchanara on Unsplash

In late July, a programmer at Estonia’s CoinsPaid, the world’s biggest crypto payment provider, met over video link with a recruiter who had reached out on LinkedIn with a lucrative job offer. During the 40-minute job interview, the engineer was asked to download a file to take a technical test, which he did on his work computer.

A few days later, on July 22, the CoinsPaid security team noticed a series of unusual withdrawals – money was quickly being drained from company accounts. By the time they were able to shut everything down and kick out the hackers four-and-a-half hours later, CoinsPaid had lost US$37mil (RM169.3mil), and both the origin of the stolen crypto and the addresses of the digital wallets that received it had been carefully obscured.