How North Korea Casually Tried to Hack Your Crypto Dreams (And Failed Spectacularly)

Ah, the ever-charming North Korean hackers, otherwise known as the Lazarus Group—because nothing says “holiday cheer” quite like state-sponsored deception. These enterprising villains have taken to the grand old U.S. of A. with the subtlety of a bull in a china shop, setting up shell companies to dangle job offers like a carrot for crypto developers. Spoiler alert: the carrots were laced with malware, and the carrots didn’t come from the garden, but rather from La-La Land.

Reuters, that bastion of unrelenting truth, uncovered two such gems: Blocknovas LLC plopped down in New Mexico and Softglide LLC shimmying about in New York. Both were crafted with all the finesse of a school play—falsified names, fake addresses (one of which was nothing more than a patch of dirt in South Carolina), and documentation so forgery-chic it could win awards. And then there’s Angeloper Agency—because what’s a crime spree without a floating enigma?

Empty Lots, Empty Promises, and Malware Galore

Silent Push informed us that the wizardry behind this charade is courtesy of a Lazarus subgroup working under North Korea’s Reconnaissance General Bureau. In plain English: these are the hackers who turned cybercrime into an art form, with all the grace of a tap-dancing rhinoceros.

Their game? Spinning a web of fake LinkedIn profiles and job listings, like cunning sirens luring unsuspecting crypto talents into interviews where the real business was installing malware. Charming, isn’t it? Blocknovas had the nerve to list a patch of grass in South Carolina as its office—because who doesn’t like working from a scenic vacant lot? Meanwhile, Softglide used a Buffalo tax prep service to keep things spicy, making it just confusing enough for a proper whodunit mystery.

Thankfully, the FBI has dismantled the Blocknovas stage, slapping a notice that reads, “We lied, you downloaded, and we spy,” or something to that effect.

The Lazarus Group: Crypto’s Not-So-Friendly Neighborhood Villains

These hackers have quite a habit of dressing up as benevolent employers—remember “ClickFix?” The campaign where job seekers in the CeFi sector got more than they bargained for, courtesy of fake interviews and malware invites. They’ve impersonated heavyweights like Coinbase and Tether, because why not add a dash of corporate cosplay to their crimes?

And lest we forget, the pièce de résistance: a $625 million heist in 2021, where a dodgy job offer led to the Ronin Bridge hack. Nothing says “welcome to the crypto world” like losing over half a billion dollars thanks to a fake recruiter with dubious intentions. Bravo, Lazarus. Bravo.

Read More

2025-04-26 23:27