when

North Korean hacking group WaterPlum stole at least $10.7 million by posing as recruiters for legitimate crypto and AI companies, attacking unsuspecting job seekers with malware.&nbsp;
The group, also known as Contagious Interview, targets software developers and IT professionals worldwide, <a href="https://www.bnd.bund.de/EN/Public-Intelligence/joint-cybersecurity-advisory/20260918-prk-waterplum-node.html" rel="noopener noreferrer nofollow">according</a> to a joint advisory from Japan, Germany, Australia and the US. Authorities said the fake recruiters also impersonated non-fungible token (NFT) companies and used recruiting services.
“The primary targets were individual web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies,” they added.&nbsp;
The advisory also links WaterPlum to North Korea’s broader campaign of placing IT workers inside foreign companies, with Japanese and US authorities assessing that WaterPlum actors and some North Korean IT workers operate under North Korea’s Munitions Industry Department.&nbsp;
According to the advisory, WaterPlum lured job seekers through social media platforms, online job platforms, gig work platforms or freelance marketplaces. During the recruitment process, victims were instructed to download and execute malicious files disguised as coding assignments or fixes for video-conferencing errors.
Related: <a href="https://cointelegraph.com/news/north-korea-using-foreign-talent-to-help-infiltrate-us-companies-report" rel="noopener noreferrer nofollow">North Korea using foreign talent to help infiltrate US companies: Report</a>
Once the cyber actors obtained backdoor access to a victim’s computer, they used remote-access trojans and infostealing malware to exfiltrate sensitive data and cryptocurrency.&nbsp;
Successful infections also create opportunities for WaterPlum actors to infiltrate organizations that employ the unsuspecting developers.&nbsp;
WaterPlum infected at least 30,000 devices in more than 100 countries, with funds or account credentials extracted from over 7,000 cryptocurrency wallets between December 2025 and July 2026.
However, the damage can extend beyond stolen cryptocurrency. Stolen identity documents allow North Korean IT workers to impersonate victims and earn income, and sensitive information could be used for extortion, it said.
The advisory described a case in which a suspected North Korean IT worker applied for an engineering role at a Japanese crypto exchange using a forged resume. The exchange rejected the applicant after finding discrepancies during the interview, including an inability to explain the skills listed in his resume in detail.
A more recent case occurred in July, when Cointelegraph reported that Consensys had unknowingly <a href="https://cointelegraph.com/news/consensys-north-korean-hacker-software-developer" rel="noopener noreferrer nofollow">engaged a North Korea-linked developer</a> as a consultant. The company told Cointelegraph it terminated their access after discovering the threat, and an investigation found no theft of assets or data, malicious code deployment or impact on user safety.
The reported campaign is the latest example of North Korea’s persistent use of cryptocurrency theft to raise funds despite <a href="https://cointelegraph.com/news/us-sentences-eight-in-five-months-laptop-farmers-north-korea" rel="noopener noreferrer nofollow">years of warnings and enforcement</a>. The <a href="https://cointelegraph.com/news/fbi-urges-crypto-private-sector-block-bybit-lazarus-laundering" rel="noopener noreferrer nofollow">FBI blamed North Korea</a> for the $1.5 billion Bybit theft in February 2025, while US authorities have <a href="https://home.treasury.gov/news/press-releases/sm481" rel="noopener noreferrer nofollow">warned</a> about its undercover IT workers since at least 2018.&nbsp;
Magazine: <a href="https://cointelegraph.com/magazine/north-korea-drives-onchain-malware-surge-coinex-shuts-asia-express" rel="noopener noreferrer nofollow">North Korea drives onchain malware surge, CoinEx shuts: Asia Express</a>

North Korean fake recruiters infect 30K devices, steal $10.7M in crypto

Cointelegraph

Other articles published on Sep 21, 2026

How NEAR moved $1B in a week without a single bridge...

Why does Ethereum's whitepaper name the mind behind Kaspa?

Coinbase CEO Hits Back at WSJ Over CLARITY Act

Injective Lands on Phantom

Syntax Verse Daily Quiz Answer 21 September 2026: Answer Inside!

Chainlink Staking Explained: LINK Security Model Guide

Join our free newsletter for daily crypto updates!