A hacking group identified as WaterPlum, also known as Contagious Interview, has compromised over 30,000 computers across more than 100 countries. According to the FBI and Japan’s National Police Agency, the group is linked to North Korea and operates under the 313 General Bureau of the Munitions Industry Department.
Between December 2025 and July 2026, the attackers siphoned at least $10.71 million in digital assets. The group targeted more than 7,000 crypto wallets by masquerading as recruiters for AI, crypto, and NFT firms. They approached developers on social media and job boards, tricking them into downloading malware disguised as coding tests or interview files.
The malware is designed to steal browser passwords, screenshots, and private keys from crypto wallets. In one instance, a suspect attempted to secure an engineering role at the Japanese exchange bitFlyer in May 2025 using a stolen resume, but was rejected after demanding payment in cryptocurrency and showing suspicious behavior during the interview.
Japanese authorities recently dismantled the country's first laptop farm, where local accomplices hosted devices remotely controlled by North Korean workers. These workers used the farm to pose as Japanese residents for freelance contracts, transferring several hundred million yen in crypto abroad. Investigators linked the farm to the same network as the WaterPlum hackers.
