According to CoinWorld news, Brian Armstrong recently announced that Coinbase will begin requiring employees to undergo in-person onboarding training and will restrict certain positions to U.S. citizens, raising questions about whether the company's new policies may violate U.S. anti-discrimination laws. In an interview with BeInCrypto, a spokesperson for Coinbase clarified that the company is not implementing a blanket 'U.S. citizens only' policy. The purpose of these changes is to combat North Korean hackers and will only affect positions that have access to sensitive systems. North Korean infiltration threat Coinbase is preparing to adopt aggressive new security policies to address the escalating threats from North Korean hackers. CEO Brian Armstrong announced last week that the company will realign its business operations with a focus on the U.S. and restrict certain positions to U.S. citizens only. The new policy stipulates that all new employees must attend in-person onboarding training. Additionally, employees handling sensitive systems must now be U.S. citizens and undergo fingerprint identification. The issues Coinbase faces are no small matter. As a leading centralized exchange, it has been a target for North Korean hackers. These state-supported threat actors have evolved their methods from traditional cyberattacks to a more insidious strategy: infiltration. This new approach includes North Korean agents applying for remote Web3 and IT positions at cryptocurrency companies. They use deceptive identities and sophisticated social engineering to gain a foothold from within, thus enabling large-scale thefts and funneling funds back to the regime. Despite the severity of the situation, the statement immediately sparked controversy and a central legal question: do these policies, particularly the citizenship requirement, violate U.S. federal anti-discrimination laws? Can Coinbase defend its measures under existing law? At first glance, Coinbase's new policy appears to directly conflict with U.S. federal law. (Immigration and Nationality Act) (INA) generally prohibits employers from discriminating based on a person's citizenship or immigration status. Given that the system is designed to ensure fair treatment of U.S. citizens, permanent residents, asylum seekers, and refugees, a blanket 'U.S. citizens only' rule for all job positions is likely illegal. However, (Immigration and Nationality Act) does recognize several key exceptions. For instance, federal law may allow employers to deny opportunities to individuals who do not meet specific national security requirements. This rule typically applies to positions requiring formal security clearances or access to classified information. Export control laws also prevent sensitive technologies from falling into the wrong hands. Among the strictest are the (International Traffic in Arms Regulations) (ITAR), which govern military and defense-related items. Broader (Export Administration Regulations) (EAR) rules cover 'dual-use' items with commercial and military applications. These laws do not mandate citizenship-based hiring. However, they can make it easier for companies to hire U.S. citizens and avoid the complicated process of obtaining special government permissions to share technology with non-U.S. persons. Finally, under federal contracting laws, companies may be required to hire U.S. citizens for certain positions. Coinbase's core legal dilemma remains whether it can successfully argue that its security-driven measures fall under one of these permitted exceptions or whether its approach sets a dangerous precedent for the tech industry. Targeted policies, rather than a blanket ban The initial news announced by Coinbase sparked speculation that the company was adopting a company-wide 'U.S. citizens only' hiring policy that would directly violate federal law. However, a spokesperson clarified in email correspondence with BeInCrypto that this interpretation was incorrect. This distinction indicates that the company is not relying on specific federal regulations to justify its policy. In fact, a spokesperson clarified that Coinbase's new security measures have no relation to any legal exceptions provided by U.S. federal law. Regarding the mandatory in-person onboarding training, Coinbase clarified that these activities will take place at regional centers for non-U.S. employees. While Coinbase's policy clearly avoids the most obvious legal pitfalls, it does enter a new, untested gray area. Beyond hiring: protecting the workforce Coinbase's position is based on the argument that the threat from North Korean actors is so severe that it necessitates taking measures that would otherwise be considered excessive intervention. Essentially, it is betting that courts will find its security rationale compelling enough to outweigh discrimination claims. In defending its position, Coinbase places its new measures within the context of a broader industry shift. To align with this trend of stricter identity verification, the company has also implemented a multilayered security approach to address internal vulnerabilities. By indicating that its policy applies to both new hires and existing employees, Coinbase positions its measures as a comprehensive response rather than discriminatory, suggesting that federal law may not fully anticipate this type of threat. Coinbase as a trial case for the cryptocurrency industry The debate over Coinbase's policies represents a broader dilemma facing the entire industry. As state-sponsored actors and malicious groups become increasingly sophisticated, companies are forced to adopt security measures that blur the lines between traditional hiring practices and national security. Given its extensive influence, Coinbase's response to these threats could set a precedent. The question is no longer whether companies can hire non-citizens. It also involves navigating the legal and ethical dilemmas of protecting themselves and their clients from these increasingly complex attacks. While Coinbase defends its actions, it remains unclear whether its model will set new industry standards or become the first test case in a new era of legal battles.