China looks forward to deeper North Korea ties, Xinhua reports

In the aftermath of North Korea's theft of $6.4 billion from Binance, a new analysis from Chainalysis reveals that the smaller losses, totalling $14.3 million over the past 18 months, may be more significant. These losses stemmed from fake job interview schemes and malware attacks targeting individuals and organizations in the crypto space.

Chainalysis analyst Tom McLouth stated that the attackers were refining their methods through multiple rounds of interviews for non-existent companies before gaining access to victims' systems. The final heist, amounting to $6.4 billion, is seen as the culmination of these preparatory attacks. Binance's recent findings confirm that the breach began with a seemingly legitimate job interview invitation that led to the compromise of an engineer's laptop.

This technique, dubbed "contagious interviews," targets employees with privileged access, making them more valuable than wealthy crypto holders. The malware was deployed through a malicious interview assignment, providing attackers with a foothold into Binance's systems. Smaller cases also show how malware can compromise cloud logins and seed phrases, highlighting the importance of securing these credentials.

The attackers also changed their malware delivery methods, using Blockchain Dead Drops to hide instructions within public blockchain transactions. Additionally, North Korean operatives posing as job applicants are using VPNs and stolen identity documents to gain remote employment worldwide, often receiving salaries in stablecoins.

This scheme has generated over $600 million annually for the regime and provides a cover for their malicious activities. The risk is particularly relevant for Southeast Asia, which boasts a large pool of remote tech talent, making it an attractive target for these sophisticated attacks.