WaterPlum Targets 30,000 Devices and Steals 7,000+ Crypto Wallet Records Worldwide

Key Takeaways:

• WaterPlum hacked over 30,000 devices in 100+ countries and accessed information from 7,000+ crypto wallets.
• Fake jobs, coding tests and malicious code targeted crypto, blockchain and Web3 developers.
• At least $1.8 million in tokens had been sent to WaterPlum’s wallets by Japanese authorities.

Japan’s National Police Agency (NPA) has exposed a large-scale cyber campaign targeting IT professionals, with cryptocurrency theft at the center of the operation. The investigation linked the WaterPlum group to activity associated with North Korean IT workers and uncovered infrastructure used to hide their identities and locations.

WaterPlum Turns Fake Jobs Into Crypto Theft

The NPA said the campaign would be initiated around December 2025 and end in July 2026. It was thought that more than 30,000 computers in over 100 countries and regions were infected.

The main targets included web developers and designers, as well as crypto and blockchain experts. WaterPlum allegedly reached out to victims through social media, recruitment sites, gigs and freelance marketplaces.

The attackers would frequently disguise themselves as trusted crypto, AI or NFT firms. Online Interviews were then followed, where candidates had to solve software problems and/or coding assignments.