North Korean Hackers Stole Data from 7,000 Crypto Wallets via Fake Job Offers
WaterPlum group infected 30,000 devices globally in a sophisticated phishing campaign targeting IT professionals.
1Global phishing operation
North Korean hacking group WaterPlum conducted a large-scale cyber attack by posing as legitimate AI, crypto, and NFT companies. They targeted IT professionals, especially web developers and blockchain engineers, through fake job offers. During interviews or test tasks, victims were tricked into downloading malware from code repositories. The operation infected over 30,000 devices across more than 100 countries between December 2025 and July 2026.
2Sophisticated malware techniques
The hackers used NPM packages to distribute malicious software families including BeaverTail, InvisibleFerret, and OtterCookie. Once installed, the malware created backdoors for remote access, stealing browser credentials, keystrokes, clipboard content, and screenshots. The primary targets were cryptocurrency wallets, with attackers specifically hunting for private keys and seed phrases to gain full control over victims' digital assets.
3Massive financial impact
WaterPlum successfully compromised data from 7,000 cryptocurrency wallets, transferring assets worth at least ¥1.7 billion ($10.8 million) to their controlled accounts. This attack follows a pattern of North Korean cybercrime, with hackers stealing over $6.7 billion since 2016 according to recent reports. The operation was particularly damaging due to its global scale and sophisticated social engineering tactics.
4International law enforcement response
Japanese National Police Agency (NPA) collaborated with FBI, Australian, and German authorities to uncover the operation. Investigations revealed WaterPlum's connection to North Korea's 313th General Bureau under the Workers' Party's Military Industry Department. This marks continued state-sponsored cybercrime activities originating from North Korea, with IT workers operating under government direction.
5Laptop farm discovery
Japanese authorities dismantled their first discovered 'laptop farm' - computers set up in a local intermediary's residence and remotely controlled by North Korean IT workers. These operations facilitated the transfer of cryptocurrency and other funds worth hundreds of millions of yen abroad. The discovery highlights North Korea's evolving infrastructure for cyber theft operations.
6Near-miss at crypto exchange
In May 2025, a suspect linked to North Korean IT networks applied for an engineering position at Japanese crypto exchange bitFlyer. The candidate used a VPN, submitted fake credentials, and insisted on remote work with crypto salary payments. The company detected suspicious behavior during interviews and prevented the infiltration, showcasing how vigilance can thwart such attacks.
7Broader security threats
Beyond cryptocurrency theft, North Korean IT workers potentially access corporate systems to steal confidential information and source code. Their operations represent a multifaceted threat to global cybersecurity. Authorities warn these activities may extend beyond financial gain to include industrial espionage and infrastructure compromise, with implications for national security.
8Critical security recommendations
NPA advises companies to minimize contractor system access, thoroughly vet candidates, and use sandboxes for untrusted code. For infected devices, immediate network isolation is crucial. Crypto holders should create new wallets from clean devices to secure assets. These measures become increasingly vital as North Korea continues refining its cyber warfare capabilities.