I Went Undercover to Interview a North Korean Crypto Hacker

**Laura Shin** (0:00)
Can you say something negative about Kim Jong Un?

**SPEAKER_2** (0:05)
I think it's not...

**Laura Shin** (0:10)
For a Korean American whose ancestors had to escape from Pyongyang, North Korea has long been a place of fascination for me. So when Taylor Monahan, North Korea's security expert and Nick Backs of Seal Alliance and UMP Labs asked me if I wanted to conduct a job interview with a North Korean crypto developer trying to get a job at UMP Labs, I jumped at the opportunity. The country's elite hackers have been stealing crypto for the dictatorship for years, for a total of what TRM Labs estimates to be over $6 billion.
Even OG companies like ConsenSys have accidentally hired what the FBI and DOJ call North Korean IT workers. In 2024, Coindesk broke the news that this problem was rampant in the industry, with well-known projects such as Cosmos Hub, Phantom, Sushi and Urine Finance, among others, having unknowingly hired North Korean state-sponsored hackers.

**Haseeb K. Qureshi** (1:00)
I cannot say this enough, guys. Every single crypto company of any significant size dating back to at least 2020 has had an IT worker. A lot of them have had 10 IT workers.

**Laura Shin** (1:12)
My number one goal when I accepted this quest was to ask the developer to say something nasty about the North Korean dictator Kim Jong Un. This is widely known as a form of kryptonite to any North Korean, with most of these DPRK devs immediately ending their job interviews upon being asked to do so. To an American who can tweet at President Donald Trump that he can go f**k himself, it seems almost laughable that North Koreans are unable to comply with this simple request. But this is how the dictatorship maintains its power, by brainwashing the population and controlling their minds and not letting any outside information in, and then by enforcing those rules with draconian physical punishments for infractions. According to international NGO Liberty in North Korea, quote, even minor criticism of Kim Jong Un can result in entire families spending the rest of their lives in a political prison camp.
Even though I've known these things for over a decade, I was still curious to see it in action. This episode is brought to you by One Inch Aqua, the shared liquidity layer from One Inch. Back multiple liquidity positions with one wallet balance, and keep your tokens in your wallet until a swap fills. See how it works at oneinch.com/aqua.
Monahan and Bax presented a document that outlined the IT worker's github, various online accounts his email address had, gigs at numerous crypto projects like GameSwap, MetaPlay, and Cook Protocol, past links between transactions from his crypto wallets at various employers to other North Korean transactions, and a screenshot of an announcement from a team he had allegedly hacked that included his headshot. While these were all allegations, the dots connected. And as I would see when I got on the call, he was the same person in the photo from the hacking announcement that also connected to those email addresses, profiles, and crypto addresses. While those parts of his identity seemed accurate and verifiable, with the caveat that it's common for North Korean IT workers to maintain specific GitHub profiles as a team, two parts did not. First, the fact that he claimed to have a US address, Long Beach, California, and second, his English name, Justin Lim. Another alias he had was Ji Kun Liao, which is likely a fake or stolen name given that the surname is Chinese. His claimed location was a thread that I could pull on to try to catch him in a lie. The fact that he had any online presence at all differentiated him from the vast majority of his fellow North Koreans, who were not only not allowed on the internet, but most of whom don't even have access to the country's intranet. Even the North Korean state-issued smartphones do not have free internet or intranet browsing. In the Hermit Kingdom, everyday North Koreans famously can face death, the gulag, or public shaming if they consume any outside media. The other thing that set him apart was that some of his internet profiles indicated that he was most likely based in Vladivostok, Russia. Meanwhile, his countrymen and women are not only not allowed to live abroad, but they are also not allowed to travel within the country without a permit. But the fact that he was privileged could have been deduced simply by the fact that he was employed as one of North Korea's state hackers, an honor reserved for members of the elite. One other fact that Bax and Monahan dropped was that he had allegedly stolen about $2.7 million from MetaPlay in 2022 So he actually had real crypto dev chops. I worried that he would be able to suss out that I was not an actual recruiter but a journalist, and that he might even hack my systems or figure out who I was. Bax helped me write questions and gave me a sense of the appropriate answers so I could react properly or make contextually accurate follow up questions. We also determined which video conferencing platform would help ensure my own safety and security without a VPN, and gave my recruiter persona a name, Sophie Wang. I find it hilarious that he and I were two ethnic Koreans pretending to be of Chinese descent with our fake last names. I was excited and also scared to come face to face or at least webcam to webcam with my hacker. Nick set me up with an Uplabs email, arranged the Zoom meeting for Friday at 2 p.m. ET, which was weirdly or not considering that his job was a form of indentured servitude Saturday 4 a.m. Vladivostok time. After a dress rehearsal with Vax, I was ready.