WaterPlum Hackers Steal $10.71M in Fake Crypto Jobs

North Korean hacking group WaterPlum, also known as Contagious Interview, allegedly stole about $10.71 million in cryptocurrency or credentials from more than 7,000 crypto wallets. The campaign infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. WaterPlum targeted developers, engineers, web designers and other professionals in the crypto, blockchain, Web3, AI and NFT sectors. Attackers posed as recruiters or technology companies on social media, job boards, freelance platforms and recruitment services. Victims were encouraged to download malware disguised as coding tests, interview materials or video-conferencing fixes. The malware enabled remote access and data theft, exposing wallet credentials, identity documents and other sensitive information. Authorities said stolen identities could also be used by North Korean IT workers to obtain jobs, impersonate victims or conduct extortion. A later Japanese investigation identified the country’s first suspected laptop farm linked to the operation. Investigators said hundreds of millions of yen in crypto assets had been moved overseas. They believe WaterPlum and some North Korean remote IT workers may have links to the Reconnaissance General Bureau’s 313 General Bureau and shared access to laptop farms and job-search services. The WaterPlum campaign adds to concerns about North Korea’s use of fake employment schemes to target the crypto industry. Traders and crypto companies should treat unsolicited recruitment files, wallet-connection requests and unfamiliar developer tools as potential security threats. The incident is unlikely to directly affect the price of a specific cryptocurrency, but further disclosures could increase risk aversion and pressure crypto-related businesses.