N. Korean hackers steal $10.7M crypto with fake jobs

A suspected North Korean hacking collective, "WaterPlum," has been implicated in a widespread cyberattack, compromising approximately 30,000 personal computers across more than 100 countries. The group specifically targeted IT professionals, including web designers and engineers specializing in cryptocurrency and Web3 technologies, between December 2025 and July 2026.

Employing deceptive tactics, "WaterPlum" posed as recruiters on social media and job platforms, offering enticing "dream job" opportunities. Victims were persuaded to download malware, such as the BeaverTail strain, under the pretense of completing coding tests or troubleshooting software during video calls. This malware provided the attackers with backdoor access, enabling them to steal login credentials for over 7,000 cryptocurrency wallets.

The group's illicit activities resulted in the theft of at least $10.7 million in virtual assets. Investigations by the FBI, alongside authorities from Japan, Germany, and Australia, revealed that "WaterPlum" operates under North Korea's 313 General Bureau of the Munitions Industry Department, potentially funding the nation's weapons development programs. Recommendations include avoiding untrusted code execution and disconnecting compromised devices from the internet.

"WaterPlum" is also linked to North Korea's strategy of having its citizens obtain remote IT jobs abroad to engage in development tasks for clients. Companies are advised to thoroughly vet job candidates to prevent infiltration.