A joint advisory from authorities in Japan, the U.S., Australia and Germany said North Korean-linked cyber actor WaterPlum infected at least 30,000 devices in more than 100 countries from around December 2025 through July 2026, using fake job offers tied to AI, cryptocurrency and NFT companies to steal funds or credentials from more than 7,000 crypto wallets.

The advisory said WaterPlum approached job seekers on social media, recruitment sites and freelance platforms while posing as legitimate employers. Victims were lured into downloading malicious files presented as coding tests, interview assignments or development projects. The primary targets were web designers, engineers and specialists working in cryptocurrency, blockchain and Web3.

Authorities said the operation infected at least 30,000 PCs across more than 100 countries, including Japan and the United States. The actors exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets and transferred at least 1.7 billion Japanese yen, or about $10.71 million, in crypto assets on behalf of North Korea.

The same advisory assessed that WaterPlum and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers' Party of Korea. Investigators also linked the campaign to the activity commonly referred to as “Contagious Interview,” a social-engineering pattern in which attackers impersonate recruiters and push malware through supposed hiring processes.

Authorities and security researchers have previously described similar operations aimed at Web3 developers, including campaigns that used fake recruiting outreach, malicious code repositories and infected technical tests. In WaterPlum’s case, the reported scale suggests a broad theft pipeline rather than a small number of highly targeted intrusions.

Why It Matters

The case highlights how crypto theft is increasingly tied to attacks on people who sit close to code, wallets and infrastructure rather than only on exchanges or protocols themselves. Hiring channels, freelance marketplaces and developer collaboration tools are becoming part of the threat surface for digital asset firms.

It also underscores the compliance dimension of DPRK-linked crypto crime. Once stolen funds move through wallets, bridges or centralized venues, exchanges and service providers may face greater pressure to strengthen address screening, transaction monitoring and internal controls around sanctioned or high-risk counterparties.