North Korean IT Worker Exposed After Refusing to Insult Kim Jong Un

Key Takeaways

• A viral video exposed a North Korean state-sponsored IT worker using an unexpected screening method: asking the candidate to insult Kim Jong Un.
• The candidate, identifying as Taro Aikuchi, a Japanese national, refused the request, raising immediate suspicion and leading to his unmasking.
• This incident highlights a simple, yet effective, behavioral filter against North Korean operatives infiltrating Western tech and crypto firms.
• While effective for now, experts caution this method should supplement, not replace, robust digital identity verification and security protocols.

A surprising and remarkably low-tech method for identifying North Korean state-sponsored IT workers attempting to gain access to Western organizations has emerged from the depths of cybersecurity and cryptocurrency communities. A viral video circulating online depicts a job candidate being exposed after refusing a seemingly straightforward, yet ideologically charged, request: to insult North Korean Supreme Leader Kim Jong Un.

The footage showcases an individual identifying as Taro Aikuchi, a Japanese national, visibly struggling and ultimately refusing to repeat a derogatory phrase about Kim Jong Un when prompted during an interview. This refusal, coupled with the candidate’s evident discomfort, immediately triggered alarms for the interviewer, leading to the operative’s eventual unmasking as a North Korean agent operating under a false identity.

The clip, initially shared on X by researcher @tanuki42_, has rapidly gained traction among security professionals and hiring managers. Its impact is particularly notable within the crypto and decentralized finance (DeFi) sectors, industries frequently targeted by Pyongyang-linked hacking groups such as Lazarus Group and TraderTraitor.

The Growing Threat of North Korean IT Operatives

The infiltration of Western companies by North Korean IT workers is a well-documented and persistent issue. Both the U.S. Department of Justice and specialized threat intelligence teams focused on the Democratic People’s Republic of Korea (DPRK) have consistently issued warnings about Pyongyang’s strategy. This involves deploying thousands of IT specialists abroad or facilitating their remote work using stolen or fabricated identities to secure positions within technology companies globally.

Once embedded, these operatives serve multiple objectives for the North Korean regime. They either generate illicit revenue, exfiltrate sensitive proprietary data, or establish backdoors that can be exploited in future cyberattacks.

The cryptocurrency and DeFi industries have become prime targets due to several inherent characteristics: their prevalent remote-first hiring models, the embrace of pseudonymous norms, and the direct access they offer to valuable digital assets. Past incidents, such as the reported $1.4 billion Bybit hack in early 2025, attributed to the Lazarus Group, illustrate the severe financial and reputational damage that can result from successful infiltration.

The Efficacy of a Low-Tech Screen

While unconventional, the interview technique leverages a fundamental psychological vulnerability. North Korean operatives are subjected to intense ideological conditioning, making any form of criticism against Kim Jong Un, even in a hypothetical or private context, a profound internal transgression. This psychological barrier appears to be a genuine filter, at least for now.

Several DeFi protocols and Web3 startups have reportedly begun incorporating this method as an additional screening layer. It complements more traditional security measures such as standard identity verification, comprehensive background checks, and document authentication processes.

However, security researchers strongly advise against relying on this as a standalone control. They emphasize that sophisticated adversaries will inevitably adapt over time. Robust defense strategies must continue to include video-verified identity checks, cross-referencing government-issued IDs, advanced IP and VPN detection, and continuous behavioral monitoring of employees post-hire.

Nevertheless, the “Taro Aikuchi” incident serves as a powerful reminder that human behavioral cues, despite their low-tech nature, can often penetrate layers of digital deception in ways that automated security tools sometimes cannot. The video has been widely shared, serving both as a cautionary tale and a darkly humorous, yet effective, addition to the contemporary threat intelligence playbook.

What You Should Do

• Implement multi-factor identity verification during hiring, including video-verified identity checks and cross-referencing government IDs.
• Utilize advanced tools for IP and VPN detection to identify suspicious connection origins.
• Conduct thorough background checks and document authentication for all new hires, especially for remote positions.
• Consider behavioral monitoring post-hire to detect anomalies that might indicate insider threats or compromised accounts.
• Educate hiring managers and security teams on potential social engineering tactics and behavioral indicators of state-sponsored operatives.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.