North Korean Hackers Target Crypto Founders with Fake Zoom Attacks

Jimmy Aki
Last Updated:

Please note that we are not authorised to provide any investment advice. The content on this page is for information purposes only.

A recent report revealed that at least three crypto founders have blocked hacking attempts linked to North Korean attackers using fake Zoom calls. The hackers pose as legitimate contacts and trick victims into downloading malware, which secretly takes control of their computers and grants access to sensitive data.

Experts Reveal How Zoom Call Attacks Exploit Human Psychology

In an X post on March 11, Nick Bax, a member of the white hat hacker group Security Alliance, explained how these hackers manipulate human psychology to carry out crypto fraud.

He shared a video showing a crypto founder in a Zoom call with what appeared to be venture capitalists (VCs), also known as investors who provide funding to startups and emerging companies, including crypto projects.

The call usually begins with multiple participants seemingly engaged in a discussion. Then, the attackers introduce an audio issue; some claim they can’t hear the target, while others insist there’s a problem on the victim’s end.

They play a stock video of a VC looking disengaged to maintain the illusion. If the target believes the issue and follows their instructions, they are directed to a different Zoom room via a fake link.

They are then asked to install a supposed software patch to fix the audio problem. In reality, this patch is malware, giving the North Korean hackers full access to the victim’s system.

The psychological trick is simple: when faced with an important meeting, victims are eager to resolve technical issues quickly, letting their guard down in the process.

Crypto Founders Share Their Experiences with Zoom Call Attacks

Bax post also revealed that this threat group has stolen tens of millions through crypto fraud, inspiring other cybercriminals to copy their tactics. His post led several crypto founders to share similar experiences.

David Zhang, co-founder of US venture-backed stablecoin Stably, recounted how he was added to a chat with a fake Joan, who posed as the CEO of Openfort. The scammer scheduled a meeting through Zhang’s Google Meet link but later claimed to have an internal meeting conflict.

They then tried to move him to a different meeting platform, using the same fake audio trick, a tactic commonly employed by North Korean hackers.

Giulio Xiloyannis, co-founder of the blockchain gaming company Mon Protocol, described a similar attempt. Scammers approached him and his head of marketing under the pretense of discussing a partnership.

Right before the meeting, they insisted on switching to a Zoom link that simulated an audio failure, attempting to get him to install malware.

Christoph, co-founder of the blockchain platform Etherisc, reported an identical scam. The attackers sent him a deceptive Zoom link—”zoom.us5web[.]us/*****”—designed to look similar to a real Zoom domain, tricking unsuspecting users.

He questioned why Zoom hadn’t secured these easily misused domains to prevent such attacks, considering the growing threat from North Korean hackers.

Melbin Thomas, founder of Devdock AI, fell for the attack. Believing the audio issue was real, he clicked the malicious link and unknowingly installed the malware. Fortunately, he didn’t enter his password during installation, which may have prevented further damage.

Crypto fraud is already rampant in 2025. In February, cybersecurity firm Kaspersky exposed hackers using fake GitHub projects to steal cryptocurrency.

Around the same time, Bybit reported a $1.4 billion exploit linked to North Korea’s Lazarus Group.

With hackers now refining their tactics through Zoom calls, crypto founders and industry professionals must stay vigilant, verify links, and remain cautious.

About Jimmy Aki PRO INVESTOR

Based in the UK, Jimmy is an economic researcher with outstanding hands-on and heads-on experience in Macroeconomic finance analysis, forecasting and planning. He has honed his skills having worked cross-continental as a finance analyst, which gives him inter-cultural experience. He currently has a strong passion for regulation and macroeconomic trends as it allows him peek under the global bonnet to see how the world works.