North Korea‑linked hackers compromise 30,000 devices and steal over $10 million from crypto wallets

Japan’s National Police Agency and the FBI warned that a North Korea‑backed hacking group, known as WaterPlum (also tracked as Contagious Interview), has infected more than 30,000 computers across 100+ countries. The campaign targeted software developers and IT professionals with fake recruitment offers, ultimately compromising over 7,000 crypto wallets and extracting at least $10.71 million in digital assets between December 2025 and July 2026.

Fake recruitment as the infection vector

WaterPlum actors pose as headhunters for AI, cryptocurrency and NFT firms. They contact potential victims on social media, job boards and freelance marketplaces, offering attractive job opportunities. Applicants are asked to complete technical interviews or coding tests that require downloading files from code‑sharing sites. Those files contain malware that harvests browser passwords, screenshots, keystrokes and, crucially, the private keys that control crypto wallets.

Scale of the operation

• More than 30,000 devices infected in over 100 countries.
• Data from over 7,000 crypto wallets compromised.
• At least $10.71 million in digital assets transferred to wallets controlled by the attackers.

Related law‑enforcement actions

Japanese police also dismantled the country’s first known “laptop farm,” where North Korean workers abroad remotely controlled compromised laptops to obtain freelance contracts and move several hundred million yen worth of crypto overseas. The same internet addresses linked the farm to WaterPlum.

Mitigation advice

Investigators now advise engineers to run any recruiter‑provided code inside a sandboxed environment, isolating it from real files and credentials.