North Korea's best exploit is your org chart
Soo Kim
Picture a quiet suburb in Texas. A dozen laptops sit on a folding table in the basement, each hum-droning on its own power strip and logged into a different U.S. company’s network. The woman who rents the house views herself as a steward-facilitator, paid by the machine to keep them online and importantly, in the right time zone. The engineers who “report” to those laptops each morning don’t actually live in the house — or the state, or even the same hemisphere. Their salaries are not paying a mortgage in Dallas.
Less than two weeks ago, the hiring process turned up in the largest crypto theft on record. On Oct. 29, attackers drained roughly $6.3 billion from Binance in what the FBI attributes to North Korea’s TraderTraitor group. By Binance’s own account, the operation ran for months and included a fake job interview. And of course, Pyongyang denies any involvement.
The Binance case is the mirror image of the laptop farm. In Texas, the fake candidate gets hired. At Binance, a real employee was recruited by a fake employer. Either way, the way in is the hiring process, which few boards — naturally — think of as a security partner.
Meanwhile, boards keep filing each episode under the same bureaucratic headings: information technology (IT) glitch, human resources (HR) oversight, a one-off cyber heist. However, it’s hard to call a monthslong campaign that began with a job interview “one-off.”
In reality, it’s none of these. A more accurate, candid snapshot would be the steady, compounding — and increasingly sophisticated, adept and maneuvering — output of a sovereign adversary playing a long, asymmetric game for economic and strategic survival. The failure that matters to the enterprise isn’t on the server or in the applicant tracking system, but in the boardroom, which may not have noticed that it is the target.
North Korea’s olden playbook was a borrowed identity, a photocopied passport and the occasional awkwardly worded, choppy email. Today, Pyongyang’s remote IT workforce has made industrial-grade improvements: real-time artificial intelligence (AI) video injection, synthetic voices and faces, and domestic proxy routing built to look like any other contractor with a functional home office.
Corporate defenses were designed for a world of paper and neatly delineated perimeters, not an adversary that adapts in real time. Employment eligibility checks, background screening software and, for the many contractors who never touch an I-9 form, a video call and a signed agreement. All of this is structurally blind to a synthetic persona built to pass exactly those porous filters. When a company hires a remote engineer a few time zones away, it assumes a human being was verified somewhere along the process. In the era of AI, however, that assumption can no longer hold — nor can this be a safeguard.
Why do enterprises with eight-figure security budgets keep falling for this? Because of how they are built. Most are entities of well-run silos with few sturdy mechanisms for cross-checking for accountability, integration and a durable strategic response during crises. HR owns talent recruitment and hiring. The chief information security officer owns security. Finance owns payroll. Legal owns compliance. Nobody owns the whole, which is convenient for every department except the company.
A threat that lives contained in any one silo gets caught. But a threat that lives in the gaps between them effectively becomes no one’s job. Hiring looks clean to HR, the network seems normal to security and the payroll file appears routine to finance. Each function sees a fragment that is unremarkable on its own; no one, then, is positioned to assemble the entire picture. And North Korea, whether by design or by happy accident, has found the one place a loosely integrated organization is guaranteed to be weak.
When a crisis or anomaly surfaces — a tax document filing discrepancy, a glitch in video latency or a payout to an unexpected crypto wallet — the organization doesn’t investigate. More realistically, it stalls in a way that might best be called a decision collapse: every function and division has a perfectly justifiable motive to wait — and the sum of all this reasonable waiting is paralysis.
For instance, legal warns against wrongful termination and privacy claims under ambiguous evidence. HR, for its part, prioritizes hiring velocity over friction. Finance, meanwhile, quietly runs payroll. And the adversary? It wins precisely in the operational gaps between these siloed departments, effectively exploiting seams wide enough to drive a state-backed proxy through.
To be clear, those cautious instincts are not irrational. Over-screening carries real costs, from discrimination claims to impediments to a company’s ability to hire talented people quickly. From a common sense perspective, no board should want a hiring process that’s so circumspect and suspecting that it treats every remote engineer as a suspect. But the answer to a bad trade-off is to design one deliberately — not to let it be made by default in whichever department blinks last.
The stakes ripple beyond embarrassment and reputational damage. Once wages reach sanctioned channels, a company can face potential exposure under U.S. sanctions rules — where the absence of intent is not always a defense, and an anomaly that was actually documented but never escalated to the proper channels can look discomfitingly like a choice. Counsel will parse the particulars, but the point for the board is simpler. And the “nobody was responsible” position isn’t an answer anyone wants to give a regulator.
Executives must stop treating sovereign risk as an IT ticket or as a checkbox to be outsourced to a vendor with a streamlined dashboard. The real fix is actually not another tool, but integration, built deliberately. A few changes would be a start:
One, name an owner for the whole. Designate one accountable executive, with a board-level committee as backstop, for the integrity of the remote workforce, from the moment a candidate applies to the moment a contractor is paid. This executive needs real authority across HR, security, finance and legal — not just a coordinating role with no leverage. Importantly, the title matters less than the answer to a simple question: When the functions disagree, who decides?
Two, build cross-functional triggers. Establish consensus in advance on the signals that matter when seen as a composite. For instance, a laptop sent to an address that doesn’t match the stated location, an always “broken” camera, changing a payment account after onboarding, a login pattern that fits a different time zone than the one provided on the application. Route those signals into a single shared case file, not three separate inboxes. Set a clock on it, so that an unresolved flag reaches the general counsel and the board within days, bypassing the middle-management layer where inconvenient facts tend to remain in limbo.
Three, decide the trade-off before the crisis. Set verification standards by role and access level. For example, a contractor touching source code or production systems likely warrants stronger identity checks, live verification and tighter access than an employee writing marketing copy. Write down the thresholds and the escalation rules in stable conditions, with counsel’s input on discrimination and privacy. That way, the people who must act in a crisis aren’t improvising under pressure and personal liability.
Fourth, stress-test the decision architecture. Run synthetic-infiltration wargames and board-level tabletops now, while the only audience is your own team, rather than after federal agents have taken your engineer’s laptop as evidence. The exercise should focus on the decisions, not the technology — who pulls access, who notifies the FBI and the board and who is willing to terminate the high-performing engineer on incomplete evidence. The gaps you find may not always be technical.
Importantly, ask the question that matters. If one of your remote engineers — your star performer — turns out tomorrow to be a state-sponsored operative, who in your company will be held accountable?
If the answer takes more than a second to give, that’s your attack surface.
Soo Kim is a former CIA analyst and strategic risk consultant, and the host of the YouTube channel @sklucidtv.