WaterPlum Hacking Group Infects Over 30,000 PCs, Steals 7,000+ Crypto Wallet Data

The North Korea-linked hacking group WaterPlum (WaterPlum) has been found to have infected over 30,000 PCs in more than 100 countries between December 2025 and July 2026, stealing over 7,000 cryptocurrency wallet records. U.S. Federal Bureau of Investigation (FBI), Japanese, Australian, and German authorities reported that WaterPlum impersonated recruitment staff at AI, cryptocurrency, and NFT companies to trick job seekers into downloading coding tasks or fixing video conference errors. The group embedded malicious code including BeaverTail, InvisibleFerret, and OtterCookie in malicious NPM packages to remotely access victims' devices and extract data. Authorities confirmed that assets worth a minimum of 1.7 billion yen (approximately $10.7 million USD / 14.8 billion KRW) had been transferred through wallets managed by WaterPlum. Victims included web developers, engineers, and professionals in cryptocurrency, blockchain, and Web3 sectors.