North Korea's Fake Job Interviews Drained $11M From 7,000 Crypto Wallets

In brief

• Police and intelligence agencies in Japan, the U.S., Australia and Germany said the group infected at least 30,000 devices across more than 100 countries.
• It took funds or credentials from over 7,000 crypto wallets and moved ¥1.7 billion, around $10.71 million, to North Korea.
• Japanese authorities dismantled a domestic "laptop farm" for the first time.

A North Korean crew that poses as recruiters to compromise developers has taken funds or credentials from more than 7,000 cryptocurrency wallets and moved around $10.71 million to Pyongyang, seven agencies across four countries said in a joint advisory published on September 18.

The group, which Japan's National Police Agency calls WaterPlum and the security industry knows as Contagious Interview, infected at least 30,000 devices in more than 100 countries between roughly December 2025 and July 2026. Targets were web designers, engineers and specialists in crypto, blockchain and Web3 work.

It is signed by Japan's National Police Agency and National Cybersecurity Office, the FBI and the U.S. Department of Defense Cyber Crime Center, the Australian Signals Directorate's Australian Cyber Security Centre, and Germany's BND foreign intelligence service and BfV domestic security agency.