# WaterPlum Cyberattack Steals Crypto Wallets via Fake IT Job Offers North Korean-linked hackers infected 30,000 devices globally through malicious coding tests. - **Source:** [CryptoNinjas](https://brifing.si/source/1b474a6a-b607-4f1e-8706-b192b0c6d750) - **Published:** 2026-09-19 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/03634cf8-252d-4033-a12c-eaf16d270444 ## Global cyberattack scale The WaterPlum hacking group compromised over 30,000 devices across more than 100 countries, primarily targeting IT professionals in crypto and blockchain sectors. Attackers posed as legitimate crypto, AI, or NFT companies on recruitment platforms. Victims were lured through social media and freelance marketplaces with fake job opportunities requiring technical assessments. This sophisticated operation lasted from December 2025 to July 2026, indicating long-term planning. ## Malware delivery mechanism Hackers conducted fake technical interviews where candidates solved coding problems or downloaded files from development repositories. These files contained malware that granted persistent system access. Five distinct malware families were identified: OtterCandy, OtterCookie, InvisibleFerret, BeaverTail, and StoatWaffle. Once installed, the malware could capture browser cookies, clipboards, keystrokes, screenshots, and files, creating comprehensive access to victims' systems. ## Cryptocurrency wallet theft The primary objective was stealing cryptocurrency wallet credentials, with over 7,000 wallet records compromised. Attackers specifically targeted private keys and seed phrases - the most sensitive components of crypto security. Investigators traced at least ¥1.7 billion ($10.71 million) transferred to WaterPlum-controlled wallets. This figure represents confirmed losses, with actual damages potentially being significantly higher given the scale of infected devices. ## North Korean IT worker connection Japanese authorities linked WaterPlum to North Korean IT workers operating through a 'laptop farm' - a facility where computers were remotely controlled to appear as Japanese-based workers. Some operatives used stolen identities and VPS services to mask their locations. The operation was directed by Bureau 313 of North Korea's Munitions Industry Department, indicating state-level involvement in this cybercrime campaign targeting financial assets. ## Attack methodology insights The campaign combined social engineering with technical exploitation. By posing as legitimate tech employers, attackers bypassed initial suspicion. The use of actual coding tests lent credibility to the operation. Multiple malware variants suggest ongoing adaptation to evade detection. The focus on IT professionals indicates deliberate targeting of individuals with access to valuable crypto assets and technical knowledge that could bypass standard security measures. ## International investigation findings The National Police Agency of Japan collaborated with the FBI to uncover the operation's infrastructure and methods. Investigators identified techniques used to hide attacker identities and locations, including VPNs and proxy servers. The discovery of the laptop farm operation revealed an additional revenue stream for North Korean IT workers beyond direct hacking activities, showing diversification in their cybercrime approaches. ## Security implications This attack highlights vulnerabilities in technical hiring processes, especially in decentralized crypto and Web3 sectors. The use of legitimate-seeming coding tests as attack vectors represents a sophisticated evolution of social engineering. IT professionals face increased risks when engaging with unsolicited job opportunities or technical assessments from unverified sources, particularly in blockchain-related fields where financial incentives for attackers are high. ## Industry-wide impact The WaterPlum operation demonstrates how cybercriminals are exploiting the growing crypto economy through targeted attacks on technical professionals. The scale of compromised devices and stolen wallet credentials suggests potential ripple effects across decentralized finance platforms. This incident underscores the need for enhanced verification in technical hiring processes and more robust security practices for professionals handling cryptocurrency assets or sensitive development projects. ## Sources covering this story - https://www.cryptoninjas.net/news/waterplum-targets-30000-devices-and-steals-7000-crypto-wallet-records-worldwide/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._