Hackers Infect Over 30,000 Devices, Steal $11 Million in Crypto Wallets

A North Korea-backed hacking group has infected over 30,000 computers in more than 100 countries, with Japanese police and the U.S. Federal Bureau of Investigation (FBI) reporting that the group stole data from over 7,000 cryptocurrency wallets on Friday.

The wallets under the group's control received at least $10.71 million in digital assets between December 2025 and July 2026. The agencies have named the group WaterPlum, also tracking it as 'Contagious Interview.'

WaterPlum poses as recruiters for AI, cryptocurrency, and NFT companies on social media, job boards, and freelance marketplaces to target developers. Applicants are asked to perform technical interviews or coding tests, with instructions to download files from code-sharing sites under the guise of connectivity issues or test assignments.

The malicious files contain malware that collects browser passwords, screenshots, keystrokes, and private keys controlling cryptocurrency wallets—software used to store digital assets.

BeInCrypto reported in August 2023 that a researcher infiltrated the group's servers for 22 months, tracking 1,640 victims across 57 countries. The latest official figures represent approximately 18 times more cases than previously documented.

Japanese authorities also dismantled Japan's first known laptop farm, where domestic collaborators stored computers controlled remotely by North Korean personnel posing as freelancers working with Japanese residents. Authorities stated the group sent hundreds of millions of yen in cryptocurrency overseas using the same internet address linking to the hacking group.

A suspect suspected of being linked to North Korea applied for a bitFlyer engineer position in May 2025, submitting a resume that claimed he refused to relocate to Japan and demanded payment in cryptocurrency. During interviews, he appeared to read responses from a second screen, leading to his rejection.