North Korea-linked hackers hit 30,000 devices, $10.7M stolen

U.S. and Japanese authorities reported that a North Korea-linked hacking group known as WaterPlum infected more than 30,000 computers across over 100 countries, compromised data from more than 7,000 cryptocurrency wallets and moved at least $10.71 million into wallets it controlled between December 2025 and July 2026.

The agencies described how WaterPlum targeted software developers and IT professionals by posing as headhunters for artificial intelligence, cryptocurrency and non-fungible token companies. Targets were invited to take technical interviews or complete coding tests and were asked to download files from code-sharing sites, with the downloads blamed on broken video calls or presented as part of the assignment.

Those downloaded files contained malware that harvested browser passwords, captured screenshots and keystrokes, and extracted the private keys that control crypto wallets. Investigators reported the group’s wallets received at least $10.71 million in digital assets during the period under review.

Official counts place the number of infected devices above 30,000 and the number of wallets with stolen data at more than 7,000. A researcher who spent 22 months inside the group’s servers previously mapped 1,640 victims in 57 countries, a tally the agencies say is far smaller than the campaign’s full scope.

Japanese police dismantled a laptop farm tied to the operation. Local accomplices kept multiple computers in their homes while North Korean operators abroad controlled the machines remotely and posed as Japanese residents to obtain freelance contracts. Investigators reported those operators moved several hundred million yen worth of cryptocurrency overseas and linked the same internet addresses to the hacking campaign.

A joint advisory from the FBI and Japan’s National Police Agency assessed that both WaterPlum actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers’ Party of Korea.

Earlier versions of the campaign used deepfake video calls to reach senior employees. In one case, a suspected North Korean applicant applied to a Japanese crypto exchange in May 2025 with a stolen resume, refused to relocate, demanded payment in cryptocurrency and appeared to read answers from a second screen; the applicant was not hired.

Authorities advised developers and job applicants to treat unsolicited recruiter code with caution, run files in isolated sandboxes that block access to real files and credentials, avoid submitting work through unfamiliar channels, and monitor wallet activity for unexplained transfers. The advisory included technical details to help employers and security teams detect and mitigate the malware.