North Korea-linked WaterPlum steals $10.7 million in crypto through fake recruiting campaign

Traders Union
All News
Crypto
North Korea WaterPlum crypto theft

Highlights

Authorities in Japan, Germany, Australia, and the U.S. identified North Korean-linked WaterPlum stealing $10.7 million in cryptocurrency via fake recruiting campaigns targeting tech job seekers.
WaterPlum uses social media, job platforms, and freelance sites to deliver malware during simulated hiring processes, primarily targeting web designers, engineers, and crypto or blockchain specialists.
The campaign enables intrusion into both individual wallets and company networks, furthering North Korea's strategy of infiltrating foreign firms, amid broader crypto sector threats like the $1.5 billion Bybit theft in February 2025.

Advisory details global malware campaign

As reported by Cointelegraph, citing a joint advisory from authorities in Japan, Germany, Australia and the U.S., the hacking group WaterPlum, also known as Contagious Interview, poses as recruiters for legitimate technology employers and attacks job seekers with malware-laced files.

The advisory says the group approaches victims through social media, job platforms, gig work sites and freelance marketplaces. During supposed hiring processes, applicants are told to download malicious coding assignments or files presented as fixes for video-conferencing problems.

After gaining backdoor access to a computer, the attackers use remote-access trojans and infostealing malware to remove sensitive data and cryptocurrency. Authorities say the campaign mainly targets web designers, engineers and specialists working in cryptocurrency, blockchain and Web3 technologies.

Wider risks for companies and the crypto sector

Successful infections also create a route into companies that employ the affected developers, extending the threat beyond individual wallet theft. The advisory links WaterPlum to North Korea's broader effort to place IT workers inside foreign companies, with Japanese and U.S. authorities assessing that the actors and some North Korean IT workers operate under North Korea's Munitions Industry Department.

Authorities say the fallout can include identity theft, extortion and fraudulent employment. The advisory cites a case in which a suspected North Korean IT worker applied for an engineering role at a Japanese crypto exchange with a forged resume, but the applicant was rejected after interview inconsistencies emerged.

The campaign adds to a longer pattern of crypto-focused fundraising activity linked to North Korea. The FBI blamed North Korea for the $1.5 billion Bybit theft in February 2025, while U.S. authorities have warned about undercover North Korean IT workers since at least 2018.

Our earlier coverage of the Senate blocking the Clarity Act explained how the failure to pass a lasting crypto market structure bill left long-term legal certainty unresolved. It also noted that the SEC and CFTC moved quickly with temporary measures—such as a five-year tokenization rule and other relief—giving firms near-term operating room while keeping investment risk in focus because agency actions can be reversed.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.