A joint advisory from the FBI and Japan’s National Police Agency, published September 18, 2026, has put a number on something crypto security researchers have warned about for years: North Korea‘s hacking apparatus is now running fake job interviews as a seed-phrase harvesting pipeline. The campaign, tracked as WaterPlum, infected more than 30,000 devices in over 100 countries and drained credentials or funds from more than 7,000 cryptocurrency wallets, according to the advisory as reported by CryptoTicker. The reported haul, about 1.7 billion Japanese yen, or roughly $10.71 million, is a fraction of what North Korea’s state-linked hackers have stolen through exchange and bridge attacks. But the method is what makes WaterPlum worth a close look: it does not break smart contracts or breach exchange infrastructure. It talks its way onto a developer’s laptop.
The timing matters too. WaterPlum’s tracked activity runs from roughly December 2025 through July 2026, overlapping with a stretch in which Chainalysis says North Korean-linked actors stole at least $2.02 billion in cryptocurrency during 2025 alone, a 51% jump from 2024, pushing the regime’s lower-bound cumulative theft total to $6.75 billion, per the Chainalysis report hosted on lazarus.day. WaterPlum’s $10.71 million is small change next to that figure. Its victim count is not.
What Happened: Inside the WaterPlum Fake Job Campaign
WaterPlum is the name investigators gave to a cluster of activity that overlaps with what other researchers call Contagious Interview, and in some reporting, Famous Chollima or Wagemole. The overlapping names reflect a familiar problem in threat intelligence: different vendors and governments track pieces of the same North Korean operation under different labels, and the lines between them are not always one-to-one. What is consistent across the reporting is the playbook. Fake recruiters reach out to software developers and IT professionals with offers for well-paid remote jobs, often pitched as roles at AI, cryptocurrency, or NFT companies, according to Forbes‘ coverage of the advisory.
Once a target engages, the “interview” moves into a technical stage. Candidates are asked to complete a coding test or troubleshoot a supposed bug in video-conferencing software. Both paths end the same way: the candidate downloads and runs code supplied by the fake employer, believing it is a test assignment or a software fix. That code is the payload.
The Coding Test Trap
The coding-test version of the lure works because it fits normal hiring behavior. Developers are used to being handed a repository, a take-home assignment, or a sample project to build locally. There is no reason to be suspicious of a zip file or a GitHub link in that context, which is exactly why North Korean operators have leaned on it for years and keep refining it.
The Video-Call Fix Trap
The second version is more opportunistic. During a scheduled video interview, the candidate is told the conferencing tool is broken and is sent a “fix,” often a small executable or script. Running it to get into the call hands the attacker code execution on the candidate’s machine, with no résumé, test, or job offer required to actually be real.
The Numbers: 30,000 Devices, 7,000 Wallets, $10.7 Million
The scale disclosed in the September advisory is the clearest public accounting of this specific campaign to date. The table below summarizes the figures as reported.
| Metric | Reported figure |
|---|---|
| Infected devices worldwide | More than 30,000 |
| Countries affected | More than 100 |
| Crypto wallets drained or compromised | More than 7,000 |
| Estimated value stolen | Approximately ¥1.7 billion (about $10.71 million) |
| Campaign activity window | Roughly December 2025 to July 2026 |
| Advisory date | September 18, 2026 |
| Agencies behind the advisory | FBI (United States), National Police Agency (Japan) |
| Primary attack vector | Fake job offers, coding tests, “video-call fix” malware |
Forbes’ reporting on the advisory attributes WaterPlum to North Korea’s 313 General Bureau, a unit under the country’s Munitions Industry Department, the same organizational umbrella associated with Pyongyang’s broader overseas remote-IT-worker schemes. That attribution ties the fake-job wallet theft directly to the same state structure that has spent years placing North Korean IT workers in disguised remote contracts at Western companies, a separate but related revenue stream for the regime.
How WaterPlum Fits Into North Korea’s Crypto Theft Machine
WaterPlum did not happen in isolation. It landed in the middle of what Chainalysis has called a record year for North Korean cryptocurrency theft, and it was followed within weeks by one of 2026’s largest single exchange hacks. Seen side by side, the numbers show just how lopsided the North Korean crypto-theft portfolio is: a handful of massive exchange and bridge compromises account for the overwhelming majority of dollars stolen, while mass social-engineering campaigns like WaterPlum rack up victim counts without moving the needle much on total value.
| Incident | Date | Reported loss | Attribution source |
|---|---|---|---|
| Bybit exchange theft | February 2025 | Approximately $1.5 billion | Chainalysis, defining event of H1 2025 |
| North Korea total, full year 2025 | 2025 | At least $2.02 billion (+51% year over year) | Chainalysis |
| Cumulative DPRK crypto theft, all years | Through 2025 | At least $6.75 billion | Chainalysis |
| WaterPlum fake-job campaign | Dec 2025 – Jul 2026 | Approximately $10.71 million, 7,000+ wallets | FBI / Japan NPA joint advisory |
| Bitget exchange theft | September 24, 2026 | Approximately $387 million | Chainalysis, via Yahoo Finance |
That Bitget figure matters for context. According to Chainalysis data cited by Yahoo Finance, the $387 million Bitget theft alone pushed the value of crypto stolen by DPRK-linked actors in 2026 above $1 billion, and the exchange said the intrusion stemmed from compromised third-party security infrastructure and forged withdrawal commands rather than a seed-phrase compromise. Separately, blockchain investigator ZachXBT has traced more than $1 billion in laundering through a Chinese organized crime network working on behalf of North Korea’s Lazarus Group, according to reporting from Cointelegraph. The laundering pipeline is a separate operational layer from the theft itself, but it explains how stolen funds keep moving even after blockchain analysts flag the wallets involved.
Historical Context: A State Hacking Program Built Around Theft
North Korea’s state-linked hacking units built their global reputation on disruptive attacks, including the Sony Pictures breach and the WannaCry ransomware outbreak that spread worldwide in 2017. Over the past decade the focus shifted hard toward direct theft, first targeting banks through the SWIFT payment network and increasingly toward cryptocurrency, which is easier to move across borders and harder to claw back once stolen.
That shift has a regional track record that predates WaterPlum. A 2026 South Korea Country Assessment Report from Crystal Intelligence, cited by crypto.news, links North Korea’s Lazarus Group to six of nine major exchange breaches involving South Korean platforms between 2017 and 2025, with confirmed thefts exceeding $120 million. WaterPlum extends that playbook from exchange infrastructure to individual developers, and from South Korea specifically to a genuinely global target list spanning more than 100 countries.
The Technical Playbook: What the Malware Actually Does
Once a victim runs the malicious coding-test package or “fix,” the payload reportedly goes to work quietly in the background. Based on the advisory’s description, the malware steals saved passwords and browser credentials, logs keystrokes, captures screenshots, scans for cryptocurrency wallet seed phrases, and collects documents including passport images, all funneled back to attacker infrastructure for later use. The seed-phrase search is the step that turns a routine credential-stealer into a direct cryptocurrency theft tool, since a 12-word or 24-word recovery phrase sitting in a text file, a password manager note, or a screenshot gives an attacker full control of a wallet with no further exploitation required.
A Parallel Technique: Clipboard Clippers
WaterPlum’s recruitment-based approach is not the only seed-phrase threat active right now, and the contrast is useful. Microsoft Threat Intelligence disclosed a Windows-based cryptocurrency clipper, active since February 2026, that combines a worm component with a clipboard-monitoring stealer, according to the Microsoft Security Blog. That malware checks the clipboard roughly every 500 milliseconds for wallet-related data, including BIP39 seed phrases, stores captured phrases locally as a backup, and exfiltrates them over the Tor network. It does not need a fake job interview. It just waits for a victim to copy a seed phrase anywhere on an already-infected machine.
A simplified version of the pattern-matching logic that clipper malware runs against clipboard contents looks roughly like this:
// Illustrative only -- shows the class of pattern clipper malware scans for
function looksLikeSeedPhrase(clipboardText) {
const words = clipboardText.trim().split(/\s+/);
const isWordCount = words.length === 12 || words.length === 24;
const isLowercaseAlpha = words.every(w => /^[a-z]+$/.test(w));
return isWordCount && isLowercaseAlpha;
}
// Defensive takeaway: never copy a seed phrase to the clipboard on any
// device that has run unverified third-party code.Separately, researchers disclosed in early October 2026 that 16 malicious Firefox extensions had been cloning the interfaces of wallets including Rabby Wallet and OKX Wallet, intercepting recovery phrases during wallet import before Mozilla pulled them from its add-on store. And in September, Malwarebytes flagged a wave of fake cryptocurrency AML “wallet-checking” websites that trick users into connecting a wallet or disclosing a recovery phrase under the guise of a compliance check, according to Security Boulevard. None of these three campaigns are confirmed to be connected to each other or to WaterPlum, but together they describe the same underlying threat from four different angles.
Competitive Comparison: How the Attack Vectors Stack Up
Treating seed-phrase theft as a single problem misses how differently each method operates, and how differently each one should be defended against. The table below lines up the four vectors covered above.
| Attack vector | Entry point | Disclosed | Reported scale |
|---|---|---|---|
| WaterPlum fake job offers | Social engineering via recruitment | Sept 18, 2026 (advisory) | 30,000 devices, 7,000 wallets, $10.71M |
| Windows clipper malware | Pre-existing infection, clipboard monitoring | Active since Feb 2026; detailed June 17, 2026 | Checks clipboard every ~500ms for BIP39 phrases |
| Malicious Firefox extensions | Browser add-on store, cloned wallet UI | Disclosed Oct 7, 2026 | 16 extensions removed by Mozilla |
| Fake AML wallet-checker sites | Phishing site posing as a compliance tool | Reported Sept 2026 | Multiple fraudulent domains tracked by Malwarebytes |
WaterPlum stands apart from the other three because it does not rely on the victim already having malware, a compromised browser, or a phishing link in hand. It builds trust first, through weeks of fake interview correspondence, and only then delivers the payload. That patience is what makes it resistant to the kind of security advice that works against the other three vectors: don’t install unverified browser extensions, don’t connect your wallet to an unfamiliar site, keep your OS patched. A developer who has been messaging a “recruiter” for two weeks is not thinking about any of that when the recruiter finally sends a test assignment.
Market Impact: Exchanges, Wallet Makers, and Hiring Platforms
The immediate financial impact of WaterPlum on the broader crypto market is modest. $10.71 million is a rounding error against a year in which Chainalysis has already tied North Korea to more than $1 billion in 2026 theft through the Bitget hack alone. The bigger impact is reputational and operational, concentrated in three places.
First, hiring platforms and remote-work marketplaces now carry real liability exposure if their job listings are used as a delivery channel for state-sponsored malware, even when the platform itself was not compromised. Second, crypto and Web3 companies that rely on fast remote hiring face pressure to add verification steps that slow down recruiting, a real cost for firms competing for scarce engineering talent. Third, wallet providers face renewed scrutiny over how easily a seed phrase can end up exposed on a developer’s own machine, regardless of how secure the wallet software itself is. A seed phrase typed into a note, saved in a password manager synced to a compromised device, or copied to a clipboard is a single point of failure that no amount of wallet-side encryption can fix.
The Official Response: What FBI and Japan’s NPA Are Telling Victims
The advisory’s core remediation advice is blunt: if a machine executed code supplied by an unverified recruiter, that machine should be treated as compromised, period. The recommended steps are to create a new wallet on a separate, clean device, move any remaining funds to that new wallet immediately, store the new seed phrase offline, and then wipe or rebuild the infected computer rather than trying to clean it in place. That sequencing matters. Moving funds before fully remediating the infected device is treated as the priority, because an attacker who already has a seed phrase can drain a wallet at any moment, while rebuilding a laptop can wait a day without making the theft worse.
Beyond individual remediation, the joint nature of the advisory, spanning two countries’ law enforcement agencies and covering victims in more than 100 others, signals that governments are starting to treat fake-job crypto theft as a cross-border problem requiring coordinated disclosure rather than country-by-country warnings.
Why Recruitment-Based Attacks Are Hard to Stop
Standard crypto security advice assumes the attacker is a stranger: a phishing email, a fake airdrop, a cloned website. WaterPlum inverts that assumption. The attacker spends real time building a plausible professional relationship before asking the victim to do anything risky, and the request, “complete this coding test,” is something developers are asked to do by legitimate employers every week. That makes the usual red flags, urgency, bad grammar, suspicious links, mostly absent. The malicious payload typically arrives wrapped inside a normal-looking project repository or a small utility that genuinely appears to fix the stated problem, which is why security teams increasingly recommend running any unverified third-party code, recruiter-supplied or otherwise, inside an isolated virtual machine or disposable environment rather than a primary development machine.
What Comes Next: 5 Predictions
- Expect more joint advisories combining several countries’ law enforcement agencies, following the FBI/Japan NPA model, as attribution data becomes easier for multiple governments to confirm independently.
- Expect crypto and AI companies to start requiring sandboxed or disposable environments for take-home coding tests, shifting a hiring norm that has gone unquestioned for years.
- Expect North Korea’s 2026 full-year crypto theft total to exceed 2025’s $2.02 billion, given that the Bitget hack alone already pushed this year’s confirmed total above $1 billion as of late September, with months still remaining in the year.
- Expect wallet providers to push harder on in-app warnings that no legitimate service, including compliance or AML checks, will ever ask for a recovery phrase, directly targeting the fake AML wallet-checker pattern flagged by Malwarebytes.
- Expect recruitment-based malware delivery to spread beyond North Korean operators, since the technique’s low cost and high success rate make it attractive to financially motivated criminal groups outside state sponsorship as well.
How Developers and Companies Can Protect Themselves
The practical defense against WaterPlum-style attacks starts before any code gets run. Verify an employer independently through its official domain and known employees rather than trusting contact details supplied by the recruiter. Treat any take-home coding test, troubleshooting request, or “fix” sent during a video call as untrusted code by default, and run it only inside an isolated virtual machine or a disposable container that has no access to real credentials, browser sessions, or wallet files. Never store a seed phrase as a text file, screenshot, note, or clipboard entry on any machine used for testing unfamiliar code. If a machine has already run suspicious recruiter-supplied code, move funds to a new wallet on a clean device immediately, store the new recovery phrase offline, and rebuild or discard the compromised machine rather than attempting to disinfect it. None of these steps require new tools or spending. They require treating a job interview with the same skepticism normally reserved for unsolicited email.
Frequently Asked Questions
What is WaterPlum?
WaterPlum is the name given to a North Korea-linked hacking campaign that uses fake job offers and coding tests to deliver malware that steals cryptocurrency wallet seed phrases and credentials. A joint FBI and Japan National Police Agency advisory disclosed the campaign on September 18, 2026.
How many crypto wallets were affected?
The advisory reports that more than 7,000 cryptocurrency wallets were drained or had credentials compromised, across more than 30,000 infected devices in over 100 countries, with losses estimated around $10.71 million.
Is WaterPlum the same as the Lazarus Group?
WaterPlum overlaps with activity other researchers track as Contagious Interview, and in some reporting, Famous Chollima or Wagemole. These names describe North Korea-linked clusters that are not always one-to-one with Lazarus Group, since different vendors and governments often track overlapping infrastructure and operators under different labels.
How does the fake job offer scam actually work?
A fake recruiter contacts a developer with a remote job offer, then asks them to complete a coding test or fix a supposed bug in video-conferencing software. The test materials or “fix” contain malware that steals credentials, keystrokes, screenshots, and cryptocurrency seed phrases.
What should I do if I ran code from a recruiter and now suspect I’m compromised?
Treat the machine as compromised immediately. Create a new wallet on a separate, clean device, move remaining funds to it, store the new seed phrase offline, and wipe or rebuild the infected computer rather than trying to clean it while connected.
How much has North Korea stolen from crypto overall?
Chainalysis estimates North Korean-linked actors stole at least $2.02 billion in cryptocurrency during 2025, a 51% increase from 2024, bringing the cumulative total since tracking began to at least $6.75 billion. The Bitget hack alone pushed the confirmed 2026 total above $1 billion as of late September.
How is WaterPlum different from the Firefox wallet extension malware or clipboard clippers?
WaterPlum delivers malware through fake job recruitment rather than a browser add-on store or a pre-existing infection. Clipboard clippers, by contrast, wait on an already-infected device and watch for seed phrases copied to the clipboard, while the malicious Firefox extensions cloned wallet interfaces to intercept phrases during wallet import.
Can antivirus software stop this kind of attack?
Antivirus tools may catch known malware signatures, but WaterPlum’s initial entry point is social engineering, not a technical exploit, so the strongest protection is never running unverified recruiter-supplied code outside an isolated environment in the first place.
