Chainalysis has linked more than $14.3 million in cryptocurrency losses over the past 18 months to North Korean groups using deceptive fake job interviews, a tactic that reportedly laid the groundwork for the $6.3 billion breach impacting Binance.
Fake job interviews used to compromise wallets
According to Chainalysis, these losses stem from employment scams and malware attacks targeting both individual crypto holders and institutional platforms, including protocols and DAOs. The firm observed a pattern of dozens of incidents where fake interview processes led to compromised private wallets and financial losses, sometimes reaching millions of dollars per target.
Tom McLouth, Senior Intelligence Analyst at Chainalysis, indicated that North Korean-affiliated groups have spent months refining these attack methods. He described the series of smaller hacks as preparation for larger-scale thefts, such as the Binance incident.
North Korean threat actors continued to evolve their methods, with job interview scams frequently leading to wallet breaches among individuals. Chainalysis identified dozens of such incidents where targets lost amounts ranging from tens of thousands to millions of dollars.
Binance traced its own breach to a phishing email inviting an engineer to participate in a job interview last September. The engineer downloaded an interview file laced with malicious code after several rounds with individuals posing as a legitimate company. Alec Zebrick, Senior Manager of Global Services at Chainalysis, labeled this tactic “contagious interviews,” noting that it is specifically aimed at personnel with privileged system access.
Several victims reported losing private keys and credentials even when their seed phrases were never stored on infected devices, indicating attackers may have gained access through stolen cloud logins or browser sessions.
Microsoft’s Defender Experts team has separately tracked a “Contagious Interview” malware campaign since at least December 2022. Attackers posing as recruiters from cryptocurrency or artificial intelligence firms directed applicants to install malicious code designed to extract wallet mnemonic phrases, password manager data, and cryptographic keys.
Chainalysis tracks growth in sophisticated cyberattacks
Chainalysis has reported a fivefold increase in blockchain-enabled cyberattacks in the past year. The organization calls these incidents “Blockchain Dead Drops,” and attributes much of the rise to nation-state actors and emerging techniques that leverage AI models with open access.
Beginning in early 2025, North Korean groups began deploying the “Etherhiding” method. This technique connects infected devices to command servers using blockchain records rather than centralized infrastructure, complicating law enforcement efforts to trace or seize instructions.
One observed approach split operational commands across both TRON and Aptos blockchains, with secondary backup routes if the primary channel failed. Additional tactics included the use of specially constructed “null receiver” addresses, which serve as covert command instructions for compromised systems but are not used for holding cryptocurrency funds.
Chainalysis noted that blockchain records are significantly harder to disrupt or confiscate compared to traditional hosting, allowing threat actors to persist even under heightened scrutiny.
In September, law enforcement agencies from the United States, Japan, Australia, and Germany attributed a $10.71 million cryptocurrency theft to a North Korean group known as WaterPlum, which also operates under the “Contagious Interview” moniker. Investigators indicated that this operation compromised sensitive data on roughly 7,000 crypto accounts.
The FBI has attributed the Binance breach to a separate North Korean group, TraderTraitor, although Pyongyang has denied any involvement. Chainalysis anticipates that the stolen assets will continue moving in the days ahead.
For crypto holders and organizations facing the rising risk of credential theft through employment scams, monitoring wallet activity and suspicious login attempts has become essential. CryptoAppsy enables users to set up immediate price and wallet movement alerts, offering a targeted way to identify abnormal activity that could signal the theft techniques currently tracked in these attacks.
