Coinbase Tightens Checks After North Korean Job Applicants

Coinbase support staff were offered hundreds of thousands of dollars to bring phones inside company facilities and photograph screens, co-founder and CEO Brian Armstrong said in an interview published Aug. 20, 2025.

Separately, Armstrong said North Korean operatives sought remote jobs at crypto firms, a tactic that prompted Coinbase to tighten checks before employees could access sensitive systems. His account did not identify the other firms or quantify how many people applied.

Armstrong said, “North Korean operatives sought remote jobs at crypto firms,” describing employment applications as an access strategy rather than evidence of a completed intrusion.

What changed at Coinbase?

Coinbase began requiring in-person orientation in the United States and stronger identity checks for people seeking sensitive system access, Armstrong said. For hires in the United States, in-person orientation adds a direct contact before work starts; for sensitive roles, stronger identity checks create an added gate before system access.

The company tied the changes to its experience with applicants, Armstrong said. He did not disclose how many applicants it reviewed, how many it hired, or what share of its U.S. workforce the orientation requirement covers. Armstrong’s account establishes a control change, not its scale.

The controls connect onboarding, identity verification and sensitive-system authorization rather than leaving hiring as a stand-alone process.

What raised concerns about the video interviews?

Armstrong’s concern about the video interviews was visible assistance: “Some applicants appeared to receive coaching from someone off camera during video interviews.”

The observation pointed to a possible weakness in remote screening because it placed assistance outside the formal interview frame. Armstrong did not say coaching alone caused a rejection or proved an applicant’s affiliation with North Korea.

What did the support-staff offers target?

Armstrong separately described offers made to Coinbase support staff. “Attackers offered Coinbase support staff hundreds of thousands of dollars to bring phones inside company facilities and photograph screens,” he said.

Unlike the job-application route, the payment scheme targeted people with an existing role and physical access. The requested action had two elements: bring a phone into a company facility and use it to capture screens. Armstrong’s account does not say any employee accepted, how many received offers, or what images were sought.

What operational gap did the two cases expose?

The two cases sat on opposite sides of onboarding. Remote applicants tried to enter through hiring, while attackers approached support workers who could already bring devices into company facilities. Tightening applicant identity checks therefore addresses one access path but does not by itself cover risks from people permitted to carry devices inside.

That distinction matters because a support role may not equal sensitive-system privileges. The phone offers did not require code theft or an account credential; the stated payoff was a photograph of a screen. Armstrong did not announce a ban on phones, a change in support staffing, or a new screen-access policy.

Armstrong left Coinbase’s response to the payment offers unspecified. The interview account provides no arrest, prosecution or loss figures.

Going forward, the next structural test for crypto companies is whether stronger identity checks, in-person orientation and tighter rules on personal devices become standard for workers who can enter facilities or reach sensitive systems.