Laura Shin interviews North Korean crypto hacker Justin Lim undercover

Laura Shin wanted to see what would happen if you put a suspected North Korean state-sponsored hacker on camera. So she pretended to be a recruiter named Sophie Wang, set up a video interview, and let the man calling himself Justin Lim talk his way through a blockchain engineering screening. He nailed the technical questions. He stumbled, rather conspicuously, on the political ones.

The resulting episode of the Unchained podcast, which aired on August 14, 2026, is one of the most unusual pieces of crypto journalism in recent memory. It’s part sting operation, part job interview, and part case study in how the Democratic People’s Republic of Korea has turned remote developer work into a funding pipeline for its weapons programs.

The interview that wasn’t really a job interview

Lim presented himself as a remote developer based in Long Beach, California. On paper, his resume checked a lot of boxes. He demonstrated fluency in smart contract security, discussed indexing protocols like The Graph across multiple networks, and showed familiarity with projects including Uniswap and Velas.

The cracks showed up when Shin, still in character as Sophie Wang, steered the conversation toward North Korea’s leadership. Lim’s responses became evasive, vague, conspicuously unwilling to offer even mild criticism of Kim Jong Un. For anyone familiar with how North Korean operatives behave under questioning, that kind of reflexive loyalty is a telltale marker.

A $2.7 million trail

Lim wasn’t just a theoretical threat. Investigators subsequently linked him to a 2022 theft of $2.7 million from the MetaPlay project, connecting his identity to known North Korean hacking patterns.

North Korean operatives are estimated to have stolen over $6 billion from crypto enterprises in recent years. And unlike ransomware gangs or lone-wolf hackers, these operatives function as employees of the state. The stolen funds reportedly flow back to support North Korea’s nuclear and ballistic missile programs, making every compromised DeFi protocol or drained project wallet a matter of international security.

The infiltration model is deceptively simple. North Korean operatives create convincing online identities, often claiming to be based in the US, Canada, or Southeast Asia. They build GitHub profiles, contribute to open-source projects, and cultivate the kind of digital footprint that a busy hiring manager might glance at and approve. Once inside a project, they have access to the exact systems they need to exploit.

Why crypto is uniquely vulnerable

The crypto industry’s hiring culture was practically designed for this kind of infiltration. Remote-first teams, pseudonymous contributors, a general tolerance for unconventional backgrounds, and the sheer velocity of hiring in bull markets all create openings that state-sponsored actors are trained to exploit.

What this means for projects and investors

Any project that has hired remote developers without rigorous identity verification now has reason to audit its own team, not just its code. A single compromised insider can drain a treasury, and the $2.7 million MetaPlay loss is modest by the standards of recent crypto exploits.

For investors, the security posture of a project’s team matters as much as the quality of its code. A protocol can pass every smart contract audit and still get gutted from the inside if the wrong person has commit access. Due diligence on token investments should now include questions about how projects vet their contributors, not just how they secure their contracts.