North Korean hacker group WaterPlum disguised as recruiters: infected 30,000 devices and stole 10.7 million USD in cryptocurrency assets

The North Korean hacker group WaterPlum disguises itself as a cryptocurrency, AI, and NFT company recruiter, deploying malware disguised as programming tasks or video conference repair files to software developers and IT professionals.

The organization has infected at least 30,000 devices in over 100 countries and extracted funds or account credentials from more than 7,000 cryptocurrency wallets between December 2025 and July 2026, stealing at least $10.7 million.