A viral video shows a new and surprisingly easy way to find North Korean state-sponsored IT workers trying to get into Western companies. The video shows Taro Aikuchi, a Japanese citizen who is applying for a job, refusing to say the phrase about Kim Jong-un again when an interviewer asks him to. His obvious discomfort and refusal to cooperate raised red flags right away, and he was quickly revealed to be a North Korean agent using a fake name.
The clip, which researcher @tanuki42_ posted on X, has gotten a lot of attention from security experts and hiring managers in the crypto and decentralized finance (DeFi) fields. Because they hire people remotely, have pseudonymous norms, and give people direct access to digital assets, the crypto and DeFi industries have been big targets.
Even though it's not a common way to do an interview, it takes advantage of a psychological fact that everyone knows: North Korean operatives are heavily influenced by ideology, which makes it hard to criticize Kim Jong Un even in a fictional setting. This method has already been added to some DeFi protocols and Web3 startups as an extra layer of security on top of standard identity verification, background checks, and document authentication. Security researchers stress that this method shouldn't be the only one used.
Sophisticated criminals may change over time, so strong defenses are needed, such as video-verified identity checks, cross-referencing government IDs, IP and VPN detection, and monitoring behavior after hiring.
