Binance’s CZ Warns Crypto Industry After SEAL Team Exposes 60 North Korean IT Worker Impersonators

Binance co-founder Changpeng "CZ" Zhao has raised urgent alarms about North Korea’s escalating use of impersonation to infiltrate cryptocurrency firms, following new findings by the ethical hacker collective Security Alliance (SEAL) that identified 60 fake IT worker profiles tied to North Korean hacking groups.

In a detailed alert on X, CZ outlined how North Korean operatives are increasingly lying their way into crypto companies by posing as job applicants for technical, security, and finance roles.

"They pose as job candidates to try to get jobs in your company. This gives them a "foot in the door", specifically for employment opportunities related to development, security and finance."

Their goals, he cautioned, are not limited to employment—some aim to bribe employees, exploit hiring processes, and deploy malware during fake interviews or customer service interactions.

Malicious actors sometimes might use the opposite side of the coin and pose as employers as a new variation of their attack

"They pose as employers and try to interview or offer jobs to employees. During the interview, they will claim that there is a problem and will send the victims a link to update their software. This software contains viruses that will take over the victims device."

Other North Korean agents will give their "applicants" coding questions which contain malicious codes or some might also pose as users to send malicious links to customer support.

SEAL Building A Repository Of North Korean Hackers

The Security Alliance (SEAL) white-hat team, led by Paradigm researcher Samczsun, compiled a repository of 60 North Korean agent aliases who have attempted to infiltrate into the U.S crypto exchange and steal their data.

The repository contains key information on their North Korean impersonators, uncovering details like pseudonyms, email addresses, phony citizenship records, work histories, and hiring patterns.

Their work underscores a growing trend: ethical hackers are now central to defending crypto platforms, with SEAL having investigated over 900 incidents since its inception, and forensic teams increasingly tracking money flows from high-profile hacks to North Korean wallets.

The North Korean infiltration threat is not theoretical—hackers linked to North Korea have been behind some of the largest and most brazen thefts in crypto, including the $1.4 billion Bybit hack. In 2024 alone, they reportedly stole more than $1.34 billion in digital assets across 47 incidents, a dramatic increase from the previous year.

Sophisticated operations use stolen or fake American identities, deepfake video tools, VPNs, and even U.S. facilitators with access to “laptop farms” to mask their locations while laundering profits back to Pyongyang’s regime.

Major exchanges Building Up Their Defence Against Attacks

Major exchanges have responded. Coinbase CEO Brian Armstrong confirmed in August the company has launched new internal controls, requiring all employees with sensitive access to receive in-person security training and submit to biometric verification.

U.S. authorities have also escalated legal actions, with the Department of Justice seizing millions tied to syndicates of North Korean IT freelancers and issuing public warnings about ongoing campaigns to compromise American financial infrastructure.

Industry experts warn crypto platforms to urgently review hiring practices, strengthen malware defenses, and train all staff to be vigilant against social engineering.

The global crypto industry is learning that even freelance developer offers, routine support tickets, or outsourcing contracts can be exploited by North Korean actors—whose cybercrime skills have grown to rival multinational organizations.

The SEAL team’s findings and CZ’s warning highlight the need for sector-wide collaboration with law enforcement, threat intelligence agencies, and ethical hacker groups.

In an ecosystem facing ever-evolving attacks, proactive defense and transparency remain essential to counter threats from nation-state actors and preserve user trust.