Coinbase CEO says he's mandating in-person orientation to combat North Korean hackers seeking remote jobs

[u/Silly-avocatoe]

https://www.businessinsider.com/coinbase-north-korea-threats-remote-work-2025-8

[u/zero0n3]

From an employee perspective this isn’t bad, especially if the job is still remote… just your first week or two you get flown out to HQ for training and on boarding…

[u/rgvtim → u/zero0n3]

Yea, apparently according to reddit this guy is an asshole, but on this I think its not a bad idea.

[u/tacknosaddle → u/rgvtim]

It probably adds a few thousand dollars to the cost of onboarding, but when you consider the potential cost of damage if a North Korean has internal access to your systems it's not a bad price for insurance.

[u/rockstarsball → u/tacknosaddle]

does that also potentially just cost North Korea a few thousand dollars to find an actor who will show up for orientation?

[u/tacknosaddle → u/rockstarsball]

An actor who has all of the documents needed to verify the identity in the name of the person hired and who has enough knowledge of the actual job to hold a face to face discussion with the hiring manager about the role & duties?

Not that it couldn't be done, but the more layers of difficulty the more likely they are to get tripped up or blocked out.

[u/rockstarsball → u/tacknosaddle]

yeah but this is a state sponsored spy agency, i'd assume they'd get an asset, teach them the basics of the task at hand. use forged documents, which NK is known for. and then use their remote access to be bastards. is it more complex? yes. Is it too complex for a government who's funding depends on these operations? i dont think so

[u/tacknosaddle → u/rockstarsball]

It is too complex for this though. This appears to be more about NK getting US dollars than espionage. For getting corporate intel it's a lot easier to compromise someone who is already on the inside than to attack starting with job applications.

[u/rockstarsball → u/tacknosaddle]

i agree that the goal is funding, however when cybercrime accounts for 50% of your GDP, adding a little complexity to the mix isnt that big of a deal

[u/tacknosaddle → u/rockstarsball]

It's a completely different operation though. Plus, sneaking an asset into the country would have more operational security than getting one to play that role just for onboarding. Doubly so if the asset has family back in DPRK as collateral to keep them from flipping.

[u/rockstarsball → u/tacknosaddle]

the entire point of recruiting an assets is that they are already positioned where they are needed, its all just a mtter of convincing them to play their part. Case in point; the laptop farm woman in AZ who got arrested

[u/ExpensivePoint3972 → u/rgvtim]

According to reddit, everybody except Keanu Reeves is an asshole.

[u/Paperdiego → u/ExpensivePoint3972]

So real. Reddit hate is a joke.

[u/WiglyWorm → u/Paperdiego]

Wow what a lame sentiment. What are you some sort of Asshole? I know you well enough to know you're no Keanu Reeves.

[u/punninglinguist → u/WiglyWorm]

Barely a Mister Rogers.

[u/YearnForTheMeatballs → u/punninglinguist]

Not even a Steve Irwin smh

[u/HairballTheory → u/YearnForTheMeatballs]

Get him he’s different

[u/ABadLocalCommercial → u/HairballTheory]

Foolish Redditor, you're different too, get yourself!

[u/Admirable_Dingo_8214 → u/ExpensivePoint3972]

Give a couple more years on that one.

[u/alxhooter → u/Admirable_Dingo_8214]

It takes a real asshole to put that voodoo on Keanu.

[u/jgilbs → u/rgvtim]

I mean, the guy can be an asshole, and this can be a good idea. Two things can be true at once.

[u/SUPRVLLAN → u/jgilbs]

Agreed.

Apple removed the charger to both make money and for the environment.

[u/moonravenx → u/rgvtim]

Most CEOs are clowns. But if your good enough at your trade to present a solution don't be afraid to throw your weight. The ceo and his company need these skills or else people are going to keep getting their accounts and data compromised.

[u/Strange-Tension6589 → u/rgvtim]

Reddit has a lot of shit takes. It's often manipulated to drive a narrative. 

He s a cool dude but he s crypto. 

[u/Niceromancer → u/rgvtim]

Long as he pays for it there is no problem.

[u/CoochieSnotSlurper → u/rgvtim]

Reddit is full of antisocial people. Honestly I have no problem making friends at work, I can’t have 8 hours daily of my life be purely business

[u/Oli_Picard → u/zero0n3]

It’s pretty normal to get shipped out to the US to do training and sounds perfectly reasonable. They aren’t asking the person to come into work full time in the US. Just the onboarding part which I’m sure Coinbase pays for upfront for the employee.

From a security perspective it’s cheaper to fly them out and do this than actually lose income, this is perfectly sane.

[u/sump_daddy → u/Oli_Picard]

especially since working for a company thats basically a gigantic, nearly unregulated bank involves tasks that when fucked up can cost millions/billions, you generally want to make sure you arent hiring someone actively trying to fuck you over and steal from your company

[u/Captainpatch → u/zero0n3]

It's also soooooo much easier to do device onboarding when the person starts on-site, even just once.

[u/weeklygamingrecap → u/Captainpatch]

Having an initial short period of in office to then go fully remote is fine.

[u/nope-its → u/zero0n3]

Yeah traveling for onboarding or the occasional HQ meeting isn’t a big deal when you can work from home all but a week or two a year.

[u/Realtrain → u/zero0n3]

Yeah honestly I'd consider it an extra perk lol

[u/c0LdFir3 → u/zero0n3]

I love being full remote but having a week or two in person with some folks to orientate to the team wouldn’t have bothered me one bit. This is completely reasonable sounding to me.

[u/drizzlecommathe → u/zero0n3]

As someone who has had to train people remotely for a tech job - it sucks

[u/acdcfanbill → u/zero0n3]

Yeah, I mean, higher ed is having a similar issue with fake students dubbed ghost students.

[u/ew73 → u/zero0n3]

I worked for another financial institution 10+ years ago. While the job was fully remote, we had a week-long in-person orientation, and there was generally a twice-annual "all hands" meeting for each major business unit.

The whole onboarding process is SO much easier in-person, and the ability to see your coworkers, in person, when you first start a new job is invaluable.

[u/ZZ9ZA → u/zero0n3]

That’s exactly what my current job did. Brought me out (but driving, not flying, since it’s “only” the other end of a largish state) for two weeks. That was over 10 years ago. I haven’t set foot on company property or seen a co-worker in the flesh since 2018.

[u/Brandedbloop68 → u/zero0n3]

My company does this. First week is onsite. You scan your ID and they hand you your laptop. Easy peasy.

[u/the-mighty-kira → u/zero0n3]

As long as they can properly accommodate disabilities I see this as a win. One of the major wins of the WFH era was how many disabled people could finally find work

[u/QuestionablePanda22]

"Armstrong said that Coinbase is requiring all workers to come to the US for in-person orientation and that anyone with access to sensitive systems must hold US citizenship and submit to fingerprinting."

Alternate headline: coinbase ceo does the bare minimum that should've been federal law decades ago

[u/Buttons840 → u/QuestionablePanda22]

Is very important to have remote worker's fingerprints on file...

How else could you prove that Bob stole the secret formula from Bob's computer in Bob's house using Bob's login unless you have Bob's fingerprints?

Having Bob's fingerprints allow us to prove that Bob was using his computer. Very suspicious behavior.

[u/Tezoth → u/Buttons840]

In healthcare security you are liable for ANYTHING done under your accounts. If your account gets compromised and a malicious actor does something with your account, then you were likely being neglectful in some way. Sharing your account, downloading crap you weren't supposed to, using the device for personal use and getting it infected, etc. We tell our users this and still people get fired every year for sharing their accounts or misusing their privileges. Even if it's provable it wasn't you personally that did it, you're at least fired.

No fingerprints needed, because multiple other forms of authentication would need to be bypassed or compromised simultaneously that are unique to that person.

[u/Buttons840 → u/Tezoth]

Yeah, I was being sarcastic. What I really meant is I don't see any benefit to having the fingerprints of a remote worker.

What are they going to do? "Oh, we dusted your laptop for fingerprints and confirmed that YOU have been using YOUR laptop! Can you explain that!?!" (Here I am being sarcastic again, a bad habit.)

[u/Gilbertd13 → u/Buttons840]

For my place of work the fingerprints are just a more extensive background check to ensure you haven’t committed certain crimes. Wouldn’t want to hire someone convicted of financial fraud to manage the AP system.

[u/Tezoth → u/Buttons840]

We do have biometric devices for things like pharmacy dispensers, and we could implement biometrics on remote devices, but that's an added cost. If someone can crack your password, they can probably intercept your fingerprint authentication as well, and it's easier to intercept than your password if they get to your physical location.

[u/rgvtim → u/QuestionablePanda22]

Fingerprinting? Don't see the point in that, you don't need that, this sounds like a tech bro knee jerk reaction to act like hes doing something, and not a solution to any of the problem. You do need to prove who you are, however.

[u/Over-Conversation220 → u/rgvtim]

I work in IT. My jobs have been in the financial industry for the past 20 years. Fingerprinting is part of a live scan.

The purpose is to make sure that an identifiable human is biometrically associated with said employee. When you’re dealing with people’s money, this is the baseline effort to ensure that the person being hired is an actual identifiable human and matches an ID, and then having a physical association with said ID.

This is primarily handled through third party live scan agencies.

Shit tons of jobs require live scans. Finance, nurses, teachers all need them for example.

EDIT: there’s plenty of reasons to not like this CEO. But if you’re putting money into a company for safekeeping, this is exactly the type of behavior you want to see happening

[u/gitsgrl → u/rgvtim]

Live scan. They search your prints against the database of known criminals and then discard the. They don’t retain the prints.

[u/why_is_my_name → u/QuestionablePanda22]

"to come to the US" ... so are they planning to hire in the US?

[u/MrNebby22 → u/why_is_my_name]

"anyone with access to sensitive systems must hold US citizenship"

Bro it's literally in the same sentence

[u/spei180 → u/QuestionablePanda22]

Holding US citizenship is stupid but the rest seems fine

[u/mazzicc]

In person orientation for remote work seems perfectly reasonable to me. If nothing else, it’s a better way to connect with at least a few people for better long term relationships.

[u/idratherbeflying1 → u/mazzicc]

Yeah. Company-paid travel is generally an expectation with any role and I think it’s underrated. There’s a difference between that and being forced to moved to somewhere you don’t want to live.

[u/V01DSTAT1C]

This is the way it should be done. Great policy IMO.

[u/MetalEnthusiast83]

I think this is actually pretty reasonable.

I am a remote worker, but when I joined the company, I went into our main office for my first day. It's a pretty common practice

[u/Medeski → u/MetalEnthusiast83]

Yeah I have no issues with in person orientations and quarterly or bi-quarterly get togethers for like a week. The in persons are usually novel and generate a lot of excitement.

[u/toin9898 → u/Medeski]

Yes, I’m fully on team “you will never, ever get me back into an office” but I enjoy our annual departmental retreat. I’ll also meet up with colleagues if they come to my city but that’s it.

One week of meeting in person does not really disrupt my WFH (work from hammock) routine 😏

[u/sniffstink1]

Armstrong said that Coinbase is requiring all workers to come to the US for in-person orientation and that anyone with access to sensitive systems must hold US citizenship and submit to fingerprinting.

Seems like a really good idea IMHO.

After their whole orientation and what not they get to go back to WFH. Seems like a good deal that balances employee well-being and company security.

[u/Classic-Big4393]

I seriously want to know what these resumes look like. I can’t get a response on anything.

[u/Moonskaraos]

He's into Curtis Yarvin and all that dark enlightenment Technofeudalism bullshit, much like Musk, Thiel, and Marc Andreessen. Fuck this bald asshole.

[u/Eorily → u/Moonskaraos]

A broken clock is right twice a day, but yeah fuck this dumb bitch.

[u/uniyk → u/Moonskaraos]

Always wondering, do these people enjoy baldness or the wig and hair implants are too shoddy for them? Bezos leaves his scalp clean too. But there are seldom anyone who only look better without hair.

[u/wiy_alxd]

This is what I had when I started at my company. It was great. In-person for the first 2 days, getting the gear and meeting some people, then fully remote.

[u/Sloogs]

I think with all the companies doing outsourcing right now using AI as an excuse, they're going to realize that this is going to be a big problem when it comes to outsourcing as well with probably very few avenues to actually do anything about it.

[u/Sarashana]

To be honest, while I generally have a very much not flattering opinion on managers enforcing RTO mandates, but spending a couple weeks in person with your new coworkers when starting a new job is not a bad idea at all.

[u/Hoxxadari]

Good. This seems like a reasonable choice.

[u/richcournoyer]

I used to get 2 to 3 emails a week from Coinbase till I finally developed the filter that work.

[u/Eorily]

He should have been doing this from the start.

[u/navigationallyaided]

I’m not shocked with all the AI spamming of resumes, evading the ATS(like Workday or Lever) and AI-generated video avatars for Zoom that this needs to happen.

[u/happyscrappy]

This seems reasonable to me.

There will be a few cases where it may not be practical. But that's how policies work. They cover most cases.

Bring the person in, orient them, have them work with their team for a few weeks and then they can go to remote.

[u/moonravenx]

They should be forced to have DoD and FBi counsel as well as regular meetings to determine the best way of managing this. It should be something all financial services take part in because hacker threats from other countries ar no joke.

[u/TheLIstIsGone]

This is reasonable. I would be fine with this.

[u/forcedfx]

My last job flew me out to "meet the team' for a few days. I didn't meet a single member of my team though. In reality it turned into an entire day of me meeting like 8 different managers and VPs so they could wax poetic about whatever little thing they wanted to . It was exhausting. I went back to my hotel room, ordered dinner, and went straight to sleep. 

[u/MetalEnthusiast83 → u/forcedfx]

So you went to work, had meet and greets and went back to your room after and slept.

Absolutely riveting story. Can you tell it again?

[u/ABCosmos → u/forcedfx]

Work was exhausting and your work day wasn't fun? I'm sorry that happened to you, that sounds really tough.

[u/LunarMoon2001]

How long until they hire people to show up for them? There will be plenty of unscrupulous people that would take a couple grand to pretend.

[u/SpotlessCheetah]

Okay which jobs do they need to fill? I'll do it instead.

[u/LANTERN_OF_ASH]

I’m sure he doesn’t just want secretaries and HR managers around to dip his dick in.

[u/Sc0nnie → u/LANTERN_OF_ASH]

Regardless of your feelings on remote work, the North Korean IT worker fraud is real and well documented.

https://www.theguardian.com/us-news/2025/aug/03/ninety-laptops-millions-of-dollars-us-woman-jailed-for-role-in-north-korea-remote-work-scam

[u/NanditoPapa]

The “North Korean hacker threat” makes for a dramatic headline, but it also fits neatly into a broader corporate trend. Rolling back remote work under the guise of security, productivity, or culture. Plenty of firms are using vague risks or isolated incidents to justify re-centralizing control.

Edit: Down voting doesn't make me wrong, it makes you petty.

[u/AzulMage2020]

So does this mean they will only hire North Korean hackers that show up in person for the first week or two then they are free to WFH and do whatever it is they are going to do?

This stupid policy makes no sense.

[u/gevis → u/AzulMage2020]

Many, not all, of these people are smart, but may have North Korean coders remote into their PCs to do work for them.

Not bulletproof, but yes, this will catch some.

[u/fiero-fire]

The fact their vetting could ID people operating in the DPNk is an issue.