North Korean Hackers Use Fake Job Interviews to Steal $11 Million from Thousands of Crypto Wallets

Police and intelligence agencies from Japan, the United States, Australia and Germany have warned that a North Korean cyber unit used fake job interviews to harvest cryptocurrency credentials and steal around $10.7 million.

Scope of the operation

The group, identified by Japan’s National Police Agency as “WaterPlum” and known in the security community as “Contagious Interview,” infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Victims were primarily web designers, engineers and specialists in crypto, blockchain and Web3.

Methodology

Actors impersonated AI, crypto or NFT companies on social media, job boards and freelance platforms. They invited candidates to technical interviews or coding tasks, then sent malicious files disguised as developer‑platform resources. The advisory lists five malware families used in the attacks, including BeaverTail, InvisibleFerret and StoatWaffle, the latter hidden in blockchain‑themed repositories.

Financial impact

Credentials from more than 7,000 cryptocurrency wallets were compromised, resulting in the transfer of ¥1.7 billion (approximately $10.71 million) to accounts linked to North Korea.

Law‑enforcement response

Japanese authorities dismantled a domestic “laptop farm” – a setup where compromised computers are remotely controlled by foreign operators – marking the first such seizure in Japan. The operation was linked to the same North Korean bureau (the 313 General Bureau of the Munitions Industry Department) that oversees other state‑sponsored hacking groups.

Broader context

CertiK attributes 60 % of all crypto‑theft losses in 2025, about $2.06 billion, to North Korean‑linked groups. The current campaign follows other high‑profile attacks, such as the $285 million Drift Protocol hack earlier in the year.