Infiltration Risks in (Crypto) Hiring - Durlston Partners
Durlston Partners
Expert talent advisory and delivery for the global technology, quantitative finance, crypto and data-science communities
Durlston Partners has once again had the opportunity to partner with DL News. This independent news organisation provides in-depth reporting on the largely misunderstood world of cryptocurrency and decentralised finance.
Karolis Kundrotas spoke with Liam J. Kelly who was investigating a disturbing trend in the crypto industry by speaking with multiple founders, recruiters, and security experts. Fake applicants are flooding job forums and slowing the hiring process, often reading from a script, or providing doctored CVs, and more often than not do not turn their cameras on during conversations to conserve their true intentions.
Below, you will find the full article in detail. We thank Liam for his time and the continued support of DL News.
North Korean hackers are infiltrating crypto job boards in a ‘quiet war’ that rakes in $600m
Hiring in the crypto industry has never been easy.
Finding skilled devs is tough, as is managing remote workers in multiple time zones.
Now, crypto staffing is about to get even harder.
A DLNews investigation has found that fake applicants are flooding job boards with doctored CVs.
Moreover, mounting evidence suggests a number of these bogus applicants appear to be North Korean nationals who are trying to infiltrate crypto projects for nefarious purposes, including gathering sensitive data, hacking, and stealing assets.
“It’s an operational hazard for the industry,” Shaun Potts, founder of crypto-specific recruiting firm Plexus, told DL News. “It’s an ongoing thing, in the same way that hacking is a thing within tech. You can’t stop it, but you can minimise its risks.”
Concealing identities
More than 4,000 North Koreans have been directed to worm their way into jobs in the technology industry in the West by concealing their identities, according to the United Nations Security Council. That includes the crypto industry.
In 58 suspected cyberheists, North Korean hackers have stolen $3 billion worth of crypto assets in the last seven years, the council said in a recent 615-page report.
While it’s unclear how many of those thefts were perpetrated with the help of fake employees, experts fear the trend is just beginning.
‘They illegally sell resources, IT work, hard labour, and hacking.’ — Taylor Monahan, MetaMask
That’s because it’s big business. The fake hiring scheme alone earns North Korea up to $600 million annually, the UN said.
“They have very limited amounts of resources they can sell to China,” Taylor Monahan, lead security researcher at crypto wallet MetaMask, told DL News. “So they generate revenue by doing things like illegally selling resources, IT work, hard labour, and hacking.”
New challenge
This development is a fresh challenge for an industry that is going mainstream. With the rollout of Bitcoin ETFs, Wall Street has embraced crypto as an asset class. DeFi stalwarts such as Solana and Aave are recording rising revenues and expanding their businesses.
The last thing crypto needs is an army of bogus job applicants as the industry scales up and demand for new hires jumps.
Ten of the largest crypto exchanges, including Coinbase and Binance, posted more than 1,200 new openings in May. Layoffs are also slowing.
According to data from Layoffs.fyi, the number of jobless people in crypto fell dramatically in the first quarter compared with the same period last year.
‘They’ve just added a couple of new roles to make it appear differently on LinkedIn search.’ — Karolis Kundrotas, Durlston Partners
“Everyone I know is either working on another project or unavailable,” Zak Cole, co-founder of crypto venture studio NUMBER GROUP, told DL News. “How are we going to bring in new talent?”
The answer — cast a wider net.
AI search
Instead of turning to a formal recruiting agency, Cole and his co-founders used an artificial intelligence tool called Applicant AI to screen applicants. It uses AI to flag keywords in CVs that meet their criteria.
The results have been mixed. In a video interview with Number Group, one applicant who listed Dutch as their native tongue hung up when asked to speak in the language.
Another applicant’s GitHub profile — a LinkedIn for programmer types — was only created a month prior, even though they were applying for a senior-level developer role.
On another résumé, an applicant for a remote working position listed a state penitentiary in Texas as a home address.
When asked if they indeed lived in a prison, the applicant said, “Yes.”
Cole’s biggest concern was making sure applicants were who they said they were.
He said a pattern emerged as he sifted through them and set up interviews: Many refused to turn on their cameras.
Video calls
Often, what they said during interviews contradicted what was written on their CVs. In other words, they were lying.
“They all have the same kind of script,” said Cole. He said their backgrounds were also blurred if they appeared on camera and that they were calling from a room with other people in it.
Karolis Kundrotas, a crypto-industry consultant at the recruiting firm Durlston Partners, said many applicants are copying real LinkedIn profiles.
“It’s the exact same experiences, and it’s the exact same kind of education as a real person,” he said. “They’ve just added a couple of new roles to make it appear differently on LinkedIn search.”
Kundrotas said video calls are crucial, too, because you can see if the person is quickly reading additional information before answering.
An applicant did precisely this during one video call shared with DL News.
The applicant indicated a deep knowledge of non-fungible tokens and crypto games, but had never heard of “Axie Infinity,” one of the industry’s largest and most well-known games.
Naturally, this is a big red flag.
Shunning background checks
Besides being a massive waste of time, these fake applicants are also doing damage to a key pillar of crypto’s ethos.
Anonymity and pseudonymity are prized values in crypto. The tendency of project teams to shun background checks and work at breakneck startup speed makes them a prime target for illegitimate hiring schemes.
For this reason, Potts says that 95% of his clients have stopped hiring pseudonymous developers.
“People underestimate the low bar across a lot of crypto,” MetaMask’s Monahan said. “It’s actually not all that uncommon for a random project to hire someone to do some work and then level them up rapidly.”
领英推荐
That may be what North Korea’s sleeper applicants are counting on.
$60,000 monthly pay
Some undercover North Korean crypto employees earn as much as $60,000 monthly and hold multiple full-time and freelance jobs.
The higher earners get to keep 30% of their earnings and hand the rest to authorities in Pyongyang, according to the UN report.
That’s why startups must remain diligent.
“They will continue to flood job posting forums, create résumés, and go after crypto companies and projects as long as it’s effective,” said Monahan.
There is a geopolitical angle to their work as well.
Erin Plante, vice-president of investigations at Chainalysis, said there is evidence North Korea is partly funding its nuclear weapons programme by hacking crypto sites. The Lazarus Group, a North Korean hacking operation, raided the Ronin bridge for $540 million in 2022, according to Elliptic, the blockchain analytics firm.
In 2019, the US Treasury Department’s Office of Foreign Assets Control sanctioned Lazarus.
If North Korea is using bogus applicants as part of this programme, that’s a major issue, said Adam Zarzinski, CEO of blockchain analytics firm Inca Digital.
“There’s this quiet war happening,” Zarzinski, a former US Air Force judge advocate, told DL News.
Written by Liam J. Kelly.
Crypto Corner
Things don't look great. Crypto lost over $277B in total market cap between Aug. 3rd and 4th, with Bitcoin briefly dropping beneath $50K and Ethereum dropping as low as $2.1K. Where has this come from?
Concerns for a US (and even global) recession are prevalent, and the Japanese yen is facing significant volatility, substantially impacting the entire market. Jump’s exit from the crypto space has added to the tension. However, as of this morning, the U.S. non-manufacturing PMI for July exceeded expectations, prompting a reassessment of the likelihood of an immediate U.S. recession and contributing to the strong rebound we witnessed yesterday (Bitcoin, Ethereum, and Solana up ~8%, ~14%, and ~18% from their lows respectively).
While the environment remains uncertain and volatility is heightened, particularly during the summer months, history has shown that crypto often rewards those who take decisive action in challenging times.
Written by Karolis Kundrotas
Market Headlines
Citadel is not like other multistrategy hedge funds. Millennium aside, it has more assets than most. It also employs more people. But its people are a slightly different type.
Multi-billion dollar hedge funds now have a place for crypto in their long-term portfolios. The scale of financial and technical resources hedge funds are allocating to Bitcoin and other cryptocurrencies is something that the market has never seen before. New York-based Millennium Management poured nearly $2 billion into Bitcoin ETFs in the first quarter. Schonfeld, Point72, Elliott Investment Management L.P., and Sculptor Capital Management are among the hedge funds holding Bitcoin ETFs.
Jump Trading significantly contributed to the crypto market sell-off, and it could be looking to sell another $104 million worth of crypto, according to QCP Group. The crash to an over five-month low was mainly caused by Ether selling from Jump Trading Group and Paradigm VC, according to an Aug. 5 report by QCP Group, which wrote: “The immediate trigger in crypto seems to have been aggressive ETH selling from Jump Trading and Paradigm VC. The move was probably exacerbated by market makers scrambling to cut short gamma as front-end ETH volumes spiked more than 30% to 120%!”.
Hot Roles
NEW CRYPTO/DEFI
JAVA DEVELOPERS
PYTHON DEVELOPERS
C++ DEVELOPERS
C# DEVELOPERS
RUST
FRONTEND/FULLSTACK
UNITED STATES
BONUS
ALL LIVE ROLES: LinkedIn / DP Website
If you're interested, click the link and apply via LinkedIn or our Website. If you have any questions regarding any of these roles, please email [email protected]
Follow our social channels to keep up to date with Durlston Partners' latest roles and daily updates - LINKTREE ??