North Korean hackers breach 7,000 crypto accounts across more than 100 countries
North Korea-linked hacking group WaterPlum carried out a large-scale cyber operation affecting more than 100 countries, including Japan. The attackers stole approximately 1.7 billion yen ($11 million) in cryptocurrency.
According to a press release from Japan's National Police Agency (NPA), the hackers infected more than 30,000 devices with malware between December 2025 and July 2026. As a result, they obtained credentials for around 7,000 cryptocurrency accounts.
The findings were included in a joint advisory issued by seven organizations across four countries, including the NPA and the U.S. Federal Bureau of Investigation. The document was published under a public attribution framework designed to formally link cyberattacks to specific groups or state entities.
Hackers posed as recruiters
According to the NPA, WaterPlum members posed as representatives of companies seeking information technology specialists. They sent prospective candidates files presented as technical assignments that contained malware.
Once a device was infected, the malware stole credentials used to access victims' crypto accounts. At least 1.7 billion yen worth of digital assets was transferred to addresses controlled by the group, with a significant portion believed to have come from compromised accounts.
The investigation also uncovered activity by North Korean IT workers based in North Korea, China and Russia. They used fake identities to secure remote jobs in software development and other technology services, with the proceeds transferred to North Korea.
Hundreds of millions of yen have been sent to North Korea through such schemes over the past several years. Law enforcement found that people in Japan assisted the operation by providing computers, servers, documents and financial accounts. Japanese police said the infrastructure has since been dismantled.
WaterPlum linked to North Korean military agency
IP addresses provided further evidence connecting the two operations. According to the report, addresses used by WaterPlum to distribute malware overlapped with infrastructure used by North Korean IT workers to find jobs and earn foreign currency.
The NPA and FBI linked WaterPlum and some of these workers to North Korea's 313 General Bureau of the Munitions Industry Department. The agency is responsible for weapons development and IT strategy under the Central Committee of the Workers' Party of Korea.
The operation comes amid record hacking activity in the crypto industry. According to Immunefi, crypto projects lost around $972 million across 207 hacks in the first half of 2026.
The number of recorded attacks was the highest in the company's tracking history. The data shows that more than 200 incidents occurred in just six months, with total losses approaching $1 billion.
Earlier, we reported that Liquid Network suspended operations after hackers withdrew around 4,000 BTC. The cryptocurrency was valued at approximately $320 million at the time of the incident.
Latest Scam Alert News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
