North Korean Cyber Group Drains $11 Million from Cryptocurrency Wallets
A North Korean cyber group, referred to as WaterPlum, has been implicated in a scheme that has drained around $11 million from more than 7,000 cryptocurrency wallets. This information comes from a joint advisory released on September 18 by seven agencies across four countries, detailing how the group posed as recruiters to target developers and IT professionals. The advisory indicates that the group infected at least 30,000 devices across over 100 countries between December 2025 and July 2026, focusing on web designers, engineers, and specialists in cryptocurrency and blockchain technologies.
The advisory, which includes contributions from Japan's National Police Agency, the FBI, and the U.S. Department of Defense Cyber Crime Center, reveals that WaterPlum is linked to North Korea's remote IT worker scheme. Both operations reportedly report to the 313 General Bureau of the Munitions Industry Department, which is part of the Workers' Party central committee. Evidence suggests that the two operations utilized the same IP addresses to conduct their activities, indicating a coordinated effort.
WaterPlum's tactics involve impersonating companies in the AI, cryptocurrency, or NFT sectors. The group approaches potential job candidates through social media, job boards, and freelance marketplaces, setting up technical interviews or coding tasks. Candidates are often instructed to download files from developer platforms, which contain malware designed to compromise their systems. The advisory identifies several malware families associated with these attacks, including BeaverTail, InvisibleFerret, and StoatWaffle, with the latter being hidden in blockchain-themed repositories.
Innovative Tactics in Recruitment Process
In a notable observation, members of the group employed AI face-swapping software during interviews, asking candidates to replicate the process, which they blamed on connection issues. They also practiced Japanese pronunciation using text-to-speech tools and engaged in leisure activities during North Korean holidays, indicating a structured approach to their operations.
Filed & Cleared
Japanese authorities have taken action against this group, dismantling a laptop farm operated by a domestic enabler, marking a significant development in the country's efforts to combat cybercrime. This operation revealed that several hundred million yen in cryptocurrency had been transferred abroad. Additionally, a Japanese crypto exchange reported rejecting an applicant in May 2025 due to inconsistencies in their résumé and communication skills.
The theft of funds by WaterPlum is part of a larger trend of cyber theft linked to North Korea. According to CertiK, North Korean-affiliated groups accounted for 60% of all cryptocurrency theft losses in 2025, totaling approximately $2.06 billion. This includes high-profile incidents such as the $285 million hack of the Drift Protocol, which involved attackers masquerading as a quantitative trading firm.
