North Korean Fraudsters Compromise 30,000 Devices and Steal $10.7M in Crypto

North Korean cybercriminal group WaterPlum has infected at least 30,000 devices in more than 100 countries and stolen at least $10.71 million in cryptocurrency through fraudulent recruitment campaigns targeting IT professionals.

According to a joint advisory from agencies in Australia, Japan, the United States, and Germany, also published by Germany’s Federal Intelligence Service, WaterPlum agents pose as prospective employers. They impersonate legitimate AI, cryptocurrency, and NFT companies and contact job seekers through social media, employment websites, gig-work platforms, and freelance marketplaces.

The German Federal Intelligence Service describes the group as “almost certainly a state-sponsored and financially motivated cyber actor.”

Candidates are invited to technical interviews or asked to complete coding assignments. The attackers then instruct them to run malicious files presented as part of the task or as a solution to a fabricated videoconferencing error. The resulting malware gives WaterPlum backdoor access, allowing it to steal credentials, personal documents, cryptocurrency, and other sensitive information from victims.

Between approximately December 2025 and July 2026, the group extracted funds or account credentials from more than 7,000 cryptocurrency wallets. The advisory says at least ¥1.7 billion ($10.71 million) in crypto has been taken from victims on behalf of North Korea.

Compromised devices can also create opportunities to enter victims’ workplaces, potentially enabling espionage, intellectual-property theft, and movement across corporate systems. Stolen identity documents could help North Korean IT workers impersonate victims, while other information could be used for extortion. 

Japanese and US authorities believe that WaterPlum and some North Korean IT workers operate under the country’s Munitions Industry Department.