A joint advisory from Japan, Germany, Australia and the United States has detailed how a North Korean hacking group known as WaterPlum stole at least $10.7 million by masquerading as recruiters for legitimate cryptocurrency and artificial‑intelligence firms. The group, also called Contagious Interview, focused on software developers and other IT professionals worldwide, according to the statement released on Thursday. It said the fake recruiters impersonated real AI, crypto and non‑fungible‑token companies and also used conventional recruiting platforms.
The advisory described the primary targets as web designers, engineers and specialists in cryptocurrency, blockchain and Web3 technologies. Recruitment took place on social‑media sites, online job boards, gig‑work marketplaces and freelance forums. Victims were asked to download and run files that were presented as coding assignments or fixes for video‑conference errors.
Once a device was infected, the attackers installed remote‑access trojans and information‑stealing malware to extract cryptocurrency wallet credentials and other sensitive data. The campaign compromised at least 30,000 devices in more than 100 countries and harvested account information from over 7,000 crypto wallets between December 2025 and July 2026.
Beyond the stolen funds, the breach gave the actors access to identity documents that could be used to impersonate victims and generate income, and the stolen data could be leveraged for extortion. One case cited by the advisory involved a suspect who applied for an engineering role at a Japanese crypto exchange with a forged résumé; the exchange rejected the applicant after interviewers could not verify the listed skills. Another recent incident, reported by Cointelegraph in July, saw Consensys unknowingly engage a North Korea‑linked developer as a consultant; the company terminated the relationship after discovering the threat, and investigators found no evidence of asset theft, malicious code deployment or user‑safety impacts.
The episode is the latest illustration of North Korea’s reliance on cryptocurrency theft to finance its activities, a pattern that has drawn repeated warnings from U.S. authorities since at least 2018. The FBI previously attributed a $1.5 billion theft from the Bybit exchange in February 2025 to North Korean actors, and the advisory underscores ongoing concerns about the regime’s use of covert IT workers to infiltrate foreign firms.

