WaterPlum Hackers Steal $10.7M From 7,000 Wallets [2026]

North Korea’s cryptocurrency theft operation just added a new chapter, and this one runs through job boards instead of exchange hot wallets. A joint law enforcement advisory published around September 18, 2026, and reported widely through September 26, names a campaign called WaterPlum, also tracked as Contagious Interview, that infected at least 30,000 devices across more than 100 countries and pulled funds or account credentials out of more than 7,000 cryptocurrency wallets. The haul: roughly 1.7 billion Japanese yen, about $10.71 million, wired back to Pyongyang between December 2025 and July 2026.

The dollar figure is modest next to the $1.5 billion Bybit theft that rocked the industry in February 2025. But the mechanics are the part worth studying. WaterPlum did not break a smart contract or brute-force an exchange. It got developers, designers, and crypto-industry employees to run code on their own machines, voluntarily, as part of what looked like a completely normal job interview. That’s a seed phrase security and endpoint security problem as much as it is a cryptocurrency one, and it’s spreading faster than most companies’ hiring processes can adapt to it.

What the Joint Advisory Actually Says