North Korean Crypto Hack Drains $10.7M From 30,000 Devices

A hacking operation tied to North Korea has managed to slip malware onto more than 30,000 devices around the world by posing as recruiters, according to a joint security advisory from authorities in the United States, Japan, Australia and Germany. The North Korean crypto hack campaign, which security researchers have named WaterPlum and linked to the long-running “Contagious Interview” operation, drained at least $10.7 million in digital assets from thousands of victims who thought they were simply applying for a tech job.

Key takeaways

• WaterPlum and Contagious Interview compromised over 30,000 devices worldwide using fake job listings.
• More than 7,000 cryptocurrency wallets were breached between December 2025 and July 2026.
• At least $10.7 million in stolen crypto was funneled into North Korean-controlled accounts.
• Victims were mostly software developers and IT specialists across over 100 countries.
• Malware families involved include BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle.

North Korean Hackers Exploit Fake Job Listings to Infiltrate 30,000 Devices

The core of this North Korean crypto hack relied on something disarmingly simple: a convincing job offer. WaterPlum operatives approached targets through social media, job boards, freelance marketplaces and professional recruiting sites, presenting themselves as hiring managers for legitimate-looking cryptocurrency, blockchain, artificial intelligence and NFT companies.