A report claims the North Korean hacker group WaterPlum posed as a recruitment agency targeting cryptocurrency, AI, and NFT firms, infecting 30,000 devices and stealing at least $10.7 million from more than 7,000 crypto wallets between December 2025 and July 2026.

According to the claim, WaterPlum used fake recruiting approaches to reach software developers and IT professionals, presenting malicious files as programming assignments or repairs needed for video conference software. The campaign was said to focus on workers connected to crypto, AI, and NFT companies.

The report described a broad cross-border operation, saying at least 30,000 devices in more than 100 countries were infected. It also said funds or account credentials were extracted from over 7,000 cryptocurrency wallets during the period from December 2025 to July 2026, with total losses of at least $10.7 million.

However, publicly verifiable support for those claims remains limited. Available follow-up checks did not identify a matching public report, law enforcement notice, or mainstream blockchain-analysis record that independently confirms the WaterPlum name, the reported victim scale, or the stated losses.

Separate reporting on other North Korean-linked hacking groups has shown similar social-engineering tactics aimed at crypto industry workers, including fake job offers, technical tests, and fraudulent video meeting prompts used to deliver malware. That background supports the broader threat pattern, but it does not independently confirm the specific WaterPlum claims or establish that the same actors were involved.

Why It Matters

Even without full public verification, the report underscores a persistent risk for the crypto sector: attackers do not need to breach a blockchain network directly if they can compromise the people building, maintaining, or accessing wallets and internal systems. Social-engineering campaigns aimed at developers and technical staff can expose private keys, browser credentials, and privileged corporate access.

The case also highlights a recurring security challenge for the industry’s institutional layer. As crypto firms expand hiring, remote collaboration, and contractor workflows, fake recruitment and meeting-based malware campaigns could become a more effective route into trading, custody, and treasury environments than direct on-chain attacks.