The Three Times North Korea (Probably) Tried to Hack My Laptop in 30 Days

I’m a 20-year senior architect. I build my own products. I thought I was too experienced to fall for a recruitment scam. I was wrong about the second part.

It is 6:47 PM on a Tuesday. I have just finished reading a 23-page technical specification that, by every objective measure, is one of the cleanest pieces of engineering documentation I have seen this year. Privacy-first architecture. EAS attestations. Soulbound NFTs on Sepolia. Deterministic scoring engines with versioned outputs. A reference architecture that maps almost perfectly to what I am already running in production on my own product.

The message that follows is short.

“Before proceeding, could you please implement the basic functionality first? Once the implementation is complete, please submit a pull request to the repository.”

I close the chat. I sit back. I look at the LED on my MacBook Pro, the one running my ANO production keys, my AWS root credentials, my Stripe live tokens, my live RavenDB connections, and the encrypted wallet for my live ERC-20 token holding real customer value on Base mainnet.

That LED was about to start blinking the wrong way.

If I had cloned that repo. If I had run npm install. Even once.

I did not. Something inside me, sharpened by twenty years of being the person who cleans up other people’s catastrophes, said no.

This is the story of how I almost lost everything. Three times. In thirty days.

The Industry’s Best-Kept Open Secret

Security researchers at Mandiant, ESET, SlowMist, and the SANS Institute have been publishing the same warning for two years. They call the operation “Contagious Interview” when they are being polite, or “DeceptiveDevelopment” when they want to be accurate. Attribution traces back to North Korea’s Lazarus Group and the dozens of imitators who studied their playbook.

Documented losses are in the hundreds of millions of dollars. Crypto wallets drained. AWS infrastructures hijacked. GitHub organizations compromised. Entire startups erased from the inside out by a single npm install on a single laptop on a single afternoon.

The targets are not careless juniors. They are senior architects, CTOs, smart contract veterans, the people who run the systems that hold the value. People exactly like me. People exactly like you.

If you are reading this and thinking “I would spot it instantly”, please stay with me. You are the demographic. You are the prize.

Attempt One: The Crude Knock at the Door

Three weeks ago, someone called Steven pinged me on Codeur about a crypto trading platform called Tirixa. Friendly tone. Real-time market data. Multi-chain support. Senior dev needed.

The third message landed the hook:

“We usually start with a small, focused Pull Request to get a sense of technical approach and working style. This task is designed to be manageable without requiring payment.”

There it was, in plain text. The exact phrasing the FBI flagged in their February 2024 advisory. The “small PR”, the “manageable”, the “without payment”. A Google Doc attached for the task. A GitHub repo URL waiting.

I have spent twenty years reading code. I can decompose a malicious package.json in my sleep. But that is precisely the point. The trap was never the code. The trap was the moment my finger hovered over git clone.

I declined politely. Asked for entity verification, NDA, paid discovery. Steven evaporated within the hour.

One down. Two to go.

Attempt Two: The Twenty-One Day Mirage

A week later, an “agency” called Aurelexa pitched me a senior architect role through Codeur. Their pitch was crisp: “Leading software development company since 2021. Skilled team of 100+ engineers, designers, QA specialists, and product experts.”

I ran one WHOIS query.

Domain Name:   AURELEXA.COM
Creation Date: 2026-04-08

The domain was twenty-one days old.

A “leading company since 2021” with a website that did not exist when the previous month started. A “team of 100+ engineers” with zero LinkedIn presence, zero Clutch reviews, zero press coverage, zero portfolio. A bare-bones HTML page hosted on a generic Namecheap shared account.

I asked for the LLC entity number. The founder’s LinkedIn. A fifteen-minute video call. The “About Us” page said the company was registered in Arkansas. The Arkansas Secretary of State registry is public, free, and takes thirty seconds to query.

They never sent the number. They went silent.

I checked the registry myself. The entity, if it exists, has not filed a single public document.

Two down.

Attempt Three: The One That Almost Worked

This is the one that scared me.

A “Jesse Walker” reached out via Codeur about StableNaira, a Nigerian Naira stablecoin. The opening was perfect:

“We are looking for an exceptional technical team leader who can guide the team effectively, strengthen execution, and help us move forward successfully.”

Unlike Tirixa and Aurelexa, this one had substance.

• Smart contracts deployed and verified on Ethereum, Base, and BNB Chain
• Listed on CoinMarketCap
• A public address announcement PDF, signed and styled like a Circle disclosure
• A burn-and-mint bridge architecture textbook-identical to Circle’s CCTP
• Open-source code published on Sourcify
• A real Dutch founder, Ronald Jans, with a verified LinkedIn profile, Fontys and Nyenrode degrees, and a 500+ connection network

By every public signal, StableNaira was real. Possibly even good.

So I did the only thing a senior engineer can do when a project looks real but something feels off.

I investigated.

The Five-Minute Checklist That Saved Me

This is the protocol I now run on every Web3 recruitment opportunity. Each step takes less than ten minutes. Each one is non-negotiable.

Step 1: Verify on-chain activity

The PDF claimed SNR was live on three mainnets. I pulled up each scanner.

• Ethereum: 0 supply, 0 holders, 0 transfers
• Base: 0 supply, 0 holders, 0 transfers
• BSC: 45 million SNR, 695 holders, ~$30,000 market cap, zero recent activity

The “live on three mainnets” was technically true and practically deceptive. First yellow flag.

Step 2: Check Ethos Network reputation

For Web3 projects, Ethos is becoming what Glassdoor is for employers. I ran the StableNaira profile.

• Score: 950, labeled Questionable (below the 1000 neutral baseline)
• Reviews: zero
• Vouches: zero
• Credible vouchers: zero
• Contributor XP: zero

A “live” stablecoin with literally no community trust signal. Second yellow flag.

Step 3: Cross-reference the recruiter on LinkedIn

I searched “Jesse Walker” plus StableNaira. No profile. No mention. No record.

I then searched the StableNaira company page directly. Four results came back. None from Nigeria. None in crypto. The closest was a Mid-Market IT executive in Oxford who, when I checked, had no public connection to the project whatsoever.

Third yellow flag, brighter than the first two.

Step 4: Reach to the source directly

I sent a verification message to Ronald Jans. He responded within hours. Yes, Jesse was part of his network. Yes, the project was real. Yes, they had a technical brief to share. He redirected me to a Telegram contact for the next steps.

For one euphoric minute, I thought I had been overcautious. I thought I was about to land a serious engagement.

Then the technical document arrived.

Step 5: Read the document, then read the message that follows it

The 23-page Proof of Dev specification was outstanding. I told them so. I outlined how I would architect the upgrade. I proposed the role: architect, team lead, structure and review rather than direct coding.

The reply hit me like a slap across the face.

“Before proceeding, could you please implement the basic functionality first? Once the implementation is complete, please submit a pull request to the repository. And additionally, we plan to begin the work after the investment has been secured.”

Read that twice. Unpaid implementation work. A pull request on a private repo. No real engagement until “after investment is secured”, which translates to never.

Whether StableNaira itself is the threat or whether someone in their recruitment chain is running an extraction script on the back of a legitimate-looking brand, the engagement structure was identical to the Lazarus playbook the FBI has been begging us to recognize for two years.

I declined. Calmly. Professionally. With the door left open.

They did not push back. They closed the conversation themselves.

What You Need to Understand

You are not too senior to fall for this.

You are not too smart.

You are not too cautious.

You are exactly who they want. The veteran who knows enough to be useful, who has enough live infrastructure to be valuable, who feels enough pride in their craft to want to demonstrate it on a quick technical task.

The Lazarus playbook does not work on people who do not care. It works on people who do.

Every red flag I caught was first a feeling. A pause. A discomfort I almost dismissed. The “second, more ambitious project” pivot. The unpaid PR ask. The reluctance to put compensation in writing. The pressure to move fast on an undefined future. These are not standard sales objections. They are operational signatures.

If you ignore them, you may not get a second chance.

The Five Rules I Now Live By

These are not opinions. They are operational rules. I have stopped negotiating them.

1. I never clone a repo from a recruiter I have not paid-verified

Read code on github.com in the browser. Never run npm install, pip install, cargo build, pnpm install, or any command that fetches and executes third-party code from a chain you have not validated to the founder, the entity, the bank account, and the contract.

2. I always demand a verifiable legal entity before any commitment

Companies House (UK). KvK (Netherlands). Sirene (France). Secretary of State (US). Ask for the number. Cross-check. A serious client gives it in thirty seconds. A scammer stalls, deflects, or vanishes.

3. I refuse all unpaid technical work, regardless of how it is framed

“Small PR”. “Quick review”. “Just an architecture diagram”. “Just a one-day prototype”. No.

A paid one-day discovery is six hundred euros. Any client who refuses to pay for one day will not pay for anything that follows. Anyone who asks for free work is either disrespecting your seniority or extracting your value. Either way, it is over.

4. I cross-reference every identity claim against five sources

LinkedIn. Twitter. Ethos Network. On-chain history. Companies House or its equivalent.

Five minutes of investigation has saved me from three impersonation attempts in thirty days. The pattern is so consistent that I now suspect every cold approach by default. Trust is earned by verification, not by warm tone.

5. I respect my engineering reflexes more than I respect the social pressure to be polite

You know that micro-pause before you click git clone. The half-second where your hand hovers, and your brain says something is wrong.

That moment is your fire alarm. Every senior engineer has it. Most of us were trained out of trusting it because client relationships require us to be agreeable.

Stop being trained out of it. Start trusting it.

What I Am Doing About It on ANO

I am building ANO (ano.ww8.io), and one of the upgrades I am shipping right now is precisely shaped by everything I just described.

ANO already gives every user a self-sovereign wallet-native identity. The next layer is a whois-style reputation lookup powered directly by Ethos Network. Inside ANO, when someone reaches out to you, claims to represent a project, sends you a job offer, or asks you to clone a repo, you will be able to pull their Ethos credibility profile in one click without leaving the chat.

The integration shows:

• The full Ethos score and tier
• Reviews, vouches, and credible vouchers
• Slash history if any exists
• Linked X handles, wallets, and verifiable on-chain footprint
• The exact information I had to gather manually across five tabs during the StableNaira investigation

The reasoning is simple. The Ethos protocol is already the closest thing Web3 has to a public reputation infrastructure. Rather than rebuild a parallel system, I plug it directly into the conversation surface where trust decisions actually get made: the moment a stranger sends you a message.

If I had had that lookup natively inside my own messenger thirty days ago, I would have seen “Questionable, score 950, zero vouches” on the StableNaira profile in less than three seconds. The decision to slow down would have been instant instead of investigative.

The whole point of ANO has always been that privacy and trust are architecture decisions made on day one or never. Adding reputation lookups via Ethos is the natural next step of that principle.

I do not want any builder, dev, or architect to have to do thirty days of manual cross-referencing the way I did. I want one click. I want the answer at the speed of the chat.

That is the upgrade. Coming soon to ANO.

Why I Am Writing This

I am writing this because the next dev who gets approached by the next polished Web3 brand asking for a “small PR” may not have the muscle memory I do.

I am writing this because the loss is not just personal. When a senior architect’s keys are compromised, the blast radius hits clients, customers, employers, downstream projects, sometimes entire ecosystems.

I am writing this because most of the warnings I see online are too technical, too abstract, or too academic. The threat does not look like a hacker. It looks like a recruiter on Codeur. It looks like a Telegram conversation with a Dutch founder. It looks like a beautifully formatted PDF that aligns perfectly with your existing work.

That is exactly what makes it dangerous.

If you take one thing from this article, take this: the modern crypto recruitment scam is engineered to look exactly like a dream opportunity. The more the pitch matches your specialty, the more attention you must pay. The more legitimate the surface, the deeper the verification must go.

You are senior because you have learned to pause. Pause harder.

Stay sharp. Stay paranoid. Stay free.

A Personal Thank You

This article would not exist without two tools that genuinely saved me.

Ethos Network is the only reason I had a hard signal to push against the legitimate-looking surface of StableNaira. A score of 950 labeled “Questionable”, with zero vouches and zero reviews, is the kind of data that cuts through the warmest pitch. The Ethos team is building the public reputation rail Web3 has needed for years, and I am grateful for it. It is now becoming a first-class integration inside ANO.

Claude (Anthropic) has been my live thinking partner through the entire thirty days. From the first WHOIS check on Aurelexa, to the cross-referencing of LinkedIn profiles, to the structured analysis of the Proof of Dev specification, to the drafting of every reply I sent on Telegram and LinkedIn. When you are alone in front of an inbox at 11 PM and the recruiter is pushing for a “quick PR”, having an honest second brain that has read every Mandiant report, every SlowMist post-mortem, every FBI advisory, and is willing to tell you to slow down, changes everything.

I would not have spotted the third attempt without both of these.

Thank you to the Ethos Network team for building public reputation infrastructure. Thank you to the Anthropic team for shipping Claude. Without you, this article would be about how I lost my keys, not how I almost did.

Builder of ANO (ano.ww8.io), a privacy-first encrypted messenger with self-custody wallet, AI agents, and a native Ethos Network reputation layer for one-click trust checks.