North Korea's WaterPlum Hackers Stole $10.71 Million in Crypto via Fake Job Interviews

A coordinated cyber-espionage campaign linked to North Korea compromised more than 30,000 devices across over 100 countries and drained at least $10.71 million from more than 7,000 cryptocurrency wallets, according to a joint advisory issued Thursday by law enforcement agencies in the United States, Japan, Australia, and Germany.

The operation, tracked internationally as WaterPlum and also known as Contagious Interview, used fake job interviews and bogus coding tests to lure web designers, engineers, and blockchain specialists into downloading malware. The stolen funds ultimately flowed to Pyongyang, authorities said.

Japan's National Police Agency led the analysis behind the advisory. The FBI and cybersecurity agencies from the other participating countries contributed intelligence gathered over months of investigation.

The campaign ran from late 2025 through July 2026, according to investigators. Attackers posed as recruiters from legitimate-sounding AI, cryptocurrency, and NFT companies, approaching targets through social media, job boards, freelance platforms, and gig-work sites.

During the fake interview process, victims were asked to complete technical assignments or coding tests that required downloading files hosted on popular development and code-sharing platforms. Those files contained malware that embedded itself in the victim's operating environment, giving attackers persistent remote access.