A North Korea-linked cyber group known as WaterPlum, also tracked as Contagious Interview, has stolen at least $10.7 million in cryptocurrency by posing as recruiters for legitimate technology, cryptocurrency, AI and NFT companies. A joint advisory from authorities in the United States, Japan, Germany and Australia said the campaign targeted software developers, engineers, web designers and other IT professionals across more than 100 countries.

The attackers used fake recruitment processes as the initial entry point. Victims were approached through social media, online job platforms, gig-work services and freelance marketplaces. After establishing contact, the attackers allegedly instructed candidates to download files presented as coding assignments, development projects or fixes for video-conferencing problems. Executing those files could give the attackers access to the victim's computer.

Authorities said WaterPlum infected at least 30,000 devices across more than 100 countries. Between December 2025 and July 2026, the campaign extracted funds or account credentials from more than 7,000 cryptocurrency wallets. The attackers reportedly used remote-access trojans and information-stealing malware to obtain sensitive information and cryptocurrency-related data after gaining access to compromised devices.

The threat extends beyond direct wallet theft. Compromised devices can expose browser credentials, personal information, identity documents and other sensitive material. Such information can potentially be used for identity impersonation, extortion or further access to organizations where victims work. A compromised developer's computer could also become an entry point into corporate systems if that individual later receives legitimate access to an employer's infrastructure.

The advisory also connects WaterPlum's activities with North Korea's broader use of overseas IT workers to generate revenue and gain access to foreign organizations. In one case described by authorities, a suspected North Korean IT worker applied for an engineering position at a Japanese cryptocurrency exchange using a forged resume. The application was rejected after inconsistencies emerged during the interview, including difficulties explaining skills claimed on the resume.

The campaign demonstrates how recruitment itself can become a cybersecurity attack surface. Coding tests, project files and technical interview tools are normally treated as routine parts of hiring, but malicious actors can exploit that trust by disguising malware as legitimate work material. The approach is particularly relevant to cryptocurrency companies, where developers and contractors frequently work remotely and may interact with wallets, private infrastructure, source code and other sensitive systems.

The financial impact is also part of a broader pattern. Authorities have repeatedly warned that North Korea-linked cyber operations use cryptocurrency theft and technology-related fraud to generate funds. The WaterPlum campaign combines that financial objective with attempts to obtain credentials, personal data and potential access to organizations.

For crypto companies and developers, the incident highlights the importance of verifying recruiters and employers before executing unfamiliar software. Technical assignments should be reviewed carefully, and suspicious files should not be opened on machines containing cryptocurrency wallets, private keys or sensitive corporate credentials. Isolating unknown code in a controlled environment can also reduce the potential impact of a malicious file.