Plum Job Offer: North Korea's WaterPlum Group Hires 30,000 Devices, Fires $10.7M

North Korean hacking collective WaterPlum, also tracked as Contagious Interview, siphoned at least $10.7 million from victims after compromising more than 30,000 devices across over 100 countries, according to a joint advisory issued by authorities in Japan, Germany, Australia and the United States. Funds or account credentials were extracted from over 7,000 cryptocurrency wallets between December 2025 and July 2026.

The group posed as recruiters tied to legitimate AI, cryptocurrency and NFT companies, and also operated through recruiting services, freelance marketplaces and gig-work platforms. "The primary targets were individual web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies," the advisory stated. Job seekers were instructed to download malicious files disguised as coding assignments or fixes for video-conferencing errors, which then installed remote-access trojans and infostealing malware.

Japanese and US authorities assess that WaterPlum actors and certain North Korean IT workers operate under the Munitions Industry Department, linking the campaign to Pyongyang's broader effort to place operatives inside foreign firms. A cited case involved a suspected North Korean IT worker who applied for an engineering role at a Japanese crypto exchange using a forged resume; the exchange rejected the applicant after the candidate could not explain the skills listed on his resume. In a more recent incident reported in July, Consensys told Cointelegraph it terminated access for a consultant later linked to North Korea, with an internal investigation finding no theft of assets or data, no malicious code deployment and no impact on user safety.

Beyond direct theft, officials warned that stolen identity documents allow North Korean IT workers to impersonate victims and earn income, while sensitive data could fuel extortion. The campaign builds on a pattern of cryptocurrency theft that the FBI has attributed to North Korea, including its February 2025 determination that Pyongyang was behind the $1.5 billion Bybit theft ($BTC), as US authorities continue to flag the regime's reliance on digital-asset heists to generate revenue.