North Korean Crypto Theft Campaigns Target Engineers With Fake Projects and Job Interviews

North Korean cryptocurrency theft operations are targeting developers and engineers with online lures to gain access to trusted systems. In the February 2025 Bybit theft, operators reportedly compromised a Safe{Wallet} engineer through a fake stock-trading project, then manipulated the wallet interface used by Bybit’s signers. Silent Push linked a domain registered hours before the theft to a known North Korean operator persona and separately identified three front companies delivering malware through fake job interviews.

The report also says Binance attributed a theft to a compromised DevOps laptop, while Silent Push identified 206 Binance-named domains as potential attack infrastructure—not confirmed malicious assets. The findings highlight developer endpoints and wallet-signing workflows as critical exposure points. Cryptocurrency firms should strengthen vetting of recruitment and project invitations, isolate untrusted development tasks, and independently verify transaction details rather than relying solely on wallet interfaces.