North Korean Hackers Steal $10.7M in Crypto via Fake Job Scam

North Korean hackers — A North Korean cyber group has stolen at least $10.7 million in cryptocurrency by posing as fake recruiters for crypto and tech firms, infecting over 30,000 devices globally.

According to a joint advisory from Japanese, German, Australian, and US authorities, the group known as WaterPlum or Contagious Interview targeted software developers and IT professionals, particularly those in cryptocurrency, blockchain, and Web3. The hackers impersonated legitimate AI, crypto, and NFT companies on social media and job platforms.

Victims were lured into downloading malicious files disguised as coding tests or software fixes. Once installed, the malware provided backdoor access, allowing the hackers to deploy remote-access trojans and information-stealing malware to drain cryptocurrency wallets.

The campaign, active between December 2025 and July 2026, resulted in the theft of funds or credentials from more than 7,000 crypto wallets across over 100 countries. Authorities warn that stolen identity documents are also used to place North Korean IT workers inside foreign companies.