WaterPlum Cyberattack Steals Crypto Wallets via Fake IT Job Offers
North Korean-linked hackers infected 30,000 devices globally through malicious coding tests.
1Global cyberattack scale
The WaterPlum hacking group compromised over 30,000 devices across more than 100 countries, primarily targeting IT professionals in crypto and blockchain sectors. Attackers posed as legitimate crypto, AI, or NFT companies on recruitment platforms. Victims were lured through social media and freelance marketplaces with fake job opportunities requiring technical assessments. This sophisticated operation lasted from December 2025 to July 2026, indicating long-term planning.
2Malware delivery mechanism
Hackers conducted fake technical interviews where candidates solved coding problems or downloaded files from development repositories. These files contained malware that granted persistent system access. Five distinct malware families were identified: OtterCandy, OtterCookie, InvisibleFerret, BeaverTail, and StoatWaffle. Once installed, the malware could capture browser cookies, clipboards, keystrokes, screenshots, and files, creating comprehensive access to victims' systems.
3Cryptocurrency wallet theft
The primary objective was stealing cryptocurrency wallet credentials, with over 7,000 wallet records compromised. Attackers specifically targeted private keys and seed phrases - the most sensitive components of crypto security. Investigators traced at least ¥1.7 billion ($10.71 million) transferred to WaterPlum-controlled wallets. This figure represents confirmed losses, with actual damages potentially being significantly higher given the scale of infected devices.
4North Korean IT worker connection
Japanese authorities linked WaterPlum to North Korean IT workers operating through a 'laptop farm' - a facility where computers were remotely controlled to appear as Japanese-based workers. Some operatives used stolen identities and VPS services to mask their locations. The operation was directed by Bureau 313 of North Korea's Munitions Industry Department, indicating state-level involvement in this cybercrime campaign targeting financial assets.
5Attack methodology insights
The campaign combined social engineering with technical exploitation. By posing as legitimate tech employers, attackers bypassed initial suspicion. The use of actual coding tests lent credibility to the operation. Multiple malware variants suggest ongoing adaptation to evade detection. The focus on IT professionals indicates deliberate targeting of individuals with access to valuable crypto assets and technical knowledge that could bypass standard security measures.
6International investigation findings
The National Police Agency of Japan collaborated with the FBI to uncover the operation's infrastructure and methods. Investigators identified techniques used to hide attacker identities and locations, including VPNs and proxy servers. The discovery of the laptop farm operation revealed an additional revenue stream for North Korean IT workers beyond direct hacking activities, showing diversification in their cybercrime approaches.
7Security implications
This attack highlights vulnerabilities in technical hiring processes, especially in decentralized crypto and Web3 sectors. The use of legitimate-seeming coding tests as attack vectors represents a sophisticated evolution of social engineering. IT professionals face increased risks when engaging with unsolicited job opportunities or technical assessments from unverified sources, particularly in blockchain-related fields where financial incentives for attackers are high.
8Industry-wide impact
The WaterPlum operation demonstrates how cybercriminals are exploiting the growing crypto economy through targeted attacks on technical professionals. The scale of compromised devices and stolen wallet credentials suggests potential ripple effects across decentralized finance platforms. This incident underscores the need for enhanced verification in technical hiring processes and more robust security practices for professionals handling cryptocurrency assets or sensitive development projects.
Original article: CryptoNinjas — WaterPlum Cyberattack Steals Crypto Wallets via Fake IT Job Offers