How North Korean Hackers Use Fake Jobs and AI to Steal Your Crypto
I used to think hackers send you virus link directly. But North Korea's Lazarus group is smarter.
They are not just yahoo boys. They are a team paid by North Korea government to steal crypto. Their job is to find money for the country's nuclear weapons. And they are very good.
In 2025 alone, they stole $2.02 billion in crypto. That is 60% of all crypto stolen in the whole world that year. That money is almost 8% of North Korea's whole economy.
Biggest one was Bybit. In February 2025, they stole $1.5 billion from Bybit exchange. That is the biggest crypto theft ever.
How do they steal it? Not how you think.
They don't hack your password. They give you a JOB.
Step 1: They create fake company. Name like Veltrix Capital or BlockNovas. They build website, LinkedIn, everything. The website looks real but it's AI-generated.
Step 2: They message you on LinkedIn, Telegram or Reddit. "Hello developer, we have a good remote job for you. Salary $150k. Can you do a small coding test?"
Step 3: You download their test from GitHub. The moment you run it, virus enters. Names are BeaverTail and InvisibleFerret. The virus quietly steals your wallet keys, MetaMask, and clipboard.
Many developers lost everything like that. One guy lost his MetaMask same day.
Now they even use AI face and AI voice for interview. The person interviewing you is not real human. It's AI photo. And they now use new encryption that even quantum computer cannot break, so police cannot track them.
After stealing, they move money quickly through 4 different blockchains in 3 hours, Ethereum, XRP, Zcash, Tron, so no one can catch them.
Why you should care in Nigeria?
If you are a crypto dev, or you apply for remote Web3 jobs, be careful. If a company you never heard of gives you a coding test to run, check them well. Don't run any code from interview.
Lazarus is still active. Last month September 2026, they stole $388 million from Bitget exchange.
Your crypto is your bank. Don't let North Korea use it to build bomb.
Source for verification:
Chainalysis report on $388M Bitget hack by Lazarus
Kaspersky Lab on Lazarus using AI and fake resumes since July 2025
ReversingLabs on fake recruiter campaign targeting devs
