Crypto Hiring Shock: The Kim Jong-Un Test Exposes North Korean Moles

by

Crypto Trust Crisis — The “Kim Jong‑Un Test” Is Exposing Secret North Korean Moles

Following another major cyberattack believed to be carried out by hackers connected to North Korea, some cryptocurrency companies are now giving potential developer hires tests designed to verify they aren’t North Korean agents.

The Fool-Proof “Kim Jong‑Un Test” For Crypto Developers

North Korea is once again making headlines with actions that sound like they’re straight out of an action movie.

After the recent $285 million attack on Drift Protocol was linked to UNC4736 – a hacking group believed to be connected to North Korea – many in the cryptocurrency world have used X (formerly Twitter) to discuss their concerns and strategies for defending against these state-sponsored attackers, who are effectively North Korean intelligence operatives.

You can find a detailed report on the attack – including how it used social engineering, fake online identities, in-person meetings, and compromised software – in an article published yesterday on our partner site, Bitcoinist.

Surprisingly, some companies have started asking job applicants to deliberately say something negative about Kim Jong-Un, the leader of North Korea, as part of their interviews.

Crypto Builders Share Proof

Yesterday, blockchain security researcher Tanuki42 posted a video reportedly showing a North Korean IT worker being asked to criticize Kim Jong Un, with a surprising reaction.

In the video, Taro Aikuchi didn’t simply struggle to repeat the interviewer’s statement calling Kim Jong-Un names. He seemed genuinely surprised and uncomfortable.

This video shows a North Korean IT worker visibly shocked and hesitant when asked to criticize Kim Jong Un.

This method isn’t a long-term solution, but it’s currently working well to identify those who can’t do it. I haven’t found anyone yet who *can*.

— tanuki42 (@tanuki42_) April 6, 2026

In another video, a security investigator shares a conversation with “Taro,” who jokingly claims to be very familiar with North Korea. However, when asked to say “Fuck Kim Jong-Un,” Taro suddenly experiences technical difficulties with his connection.

The video I shared was actually the second part of our conversation. This is the first part – I told Taro I study North Korean security, and he claimed to be very familiar with North Korea. We experienced some strange connection problems when I said something critical about Kim Jong Un, but Taro apologized when the connection was restored.

— tanuki42 (@tanuki42_) April 6, 2026

After the interview, Tanuki42 noticed the candidate had changed their Telegram username, deleted their conversation with him, and blocked him.

Taroaikuchi recently changed his Telegram username from @cryptotrading2150 to @cryptodegen202. He also deleted our conversation and blocked me.

— tanuki42 (@tanuki42_) April 6, 2026

His X account and LinkedIn page also disappeared.

Crypto investor Jason Choi shared a post by Tanuki42, adding that many crypto founders have told him this method is effective.

Several founders in crypto have told me they ran this test and it genuinely worked

— Jason Choi (@mrjasonchoi) April 6, 2026

Pav, a crypto founder and builder specializing in Real World Assets (RWAs), revealed he’s been using this strategy since 2024. He discovered he had unknowingly interviewed a North Korean agent for a job as an engineer back in 2022, which led him to adopt the practice.

have been using this since 2024 and works like a charm

— Parv (@Parv_EP) April 6, 2026

Cybersecurity expert Simon Wijckmans shared a story similar to Choi’s. He posted a clip from one of his candidate interviews where the applicant, William Nation, couldn’t bring himself to call Kim Jong-Un a dictator, even when asked to do so by Wijckmans.

Yep

— Simon (@SimonWijckmans) April 6, 2026

Some Crypto Builders Remain Sceptic

Even with a lot of proof, some people are still amazed and disbelieve the story.

Paolo Caversaccio, a Swiss engineer and entrepreneur specializing in cryptography, privacy, and security, recently described a method he uses to screen potential collaborators for ties to North Korea. He shared that he employs a tactic involving a specific insult – the same one previously used against Kim Jong-Un – to help identify possible North Korean spies.

From now on, I’m asking everyone who contributes code to my projects to include a playful insult directed at Kim Jong Un. It’s a simple way to make sure code from North Korean developers (some of whom are quite skilled) doesn’t get added to my projects – they’d never agree to that request! This person, however, didn’t seem to mind.

— sudo rm -rf –no-preserve-root / (@pcaversaccio) April 4, 2026

He then disagreed with Micah Zoltu, a veteran Ethereum developer, about how well the method actually worked. However, Caversaccio made a strong case, as he’d been working with IT professionals from North Korea for over three years.

Having worked with IT workers from North Korea for over three years, I’m confident this screening method is highly effective. We plan to publicly share some interviews in the future, linking them here, which will demonstrate that these individuals consistently struggle with this particular question. You might assume my method is just a simple…

— sudo rm -rf –no-preserve-root / (@pcaversaccio) April 5, 2026

Market Implications

Right now, successful traders aren’t focusing on short-term trends, but on finding companies that can protect against attacks from governments and sophisticated hacking groups.

The cryptocurrency world is changing. Now, things like global political events, cybersecurity threats from nations, and making sure companies follow the rules are just as crucial as checking the technology itself. The risk of hackers linked to North Korea is a constant concern for the entire industry.

Because of this, traders need to be aware that projects with poor checks on who’s involved, unclear ownership structures, or inconsistent decision-making processes carry a higher risk of sudden price drops as the market reacts to these weaknesses.

Projects demonstrating robust security practices, effective incident handling, and thorough Know Your Customer (KYC) procedures for key personnel are likely to be valued higher and attract more consistent total value locked (TVL).

Cover image from Perplexity. BTCUSDT chart from Tradingview.

Read More

2026-04-07 15:23