Japan NPA, FBI Expose North Korean Hackers Posing as Recruiters

The joint attribution matters less than the method: recruitment-themed social engineering is a supply-chain attack on the people who build and audit crypto systems, not on exchanges or protocols. That shifts the risk burden toward individual developers, whose compromised credentials and wallets can sit inside otherwise well-defended organizations. The cross-border device and wallet counts suggest this is industrialized rather than opportunistic. Whether similar recruiter-lure campaigns are being tracked by other agencies, and how hiring pipelines in crypto verify counterparties, is the open question.