North Korean hacker group WaterPlum infects 30000 devices and steals $10.7 million in encrypted assets

The North Korean hacker group WaterPlum disguised itself as a cryptocurrency, AI, and NFT company recruiting personnel to deliver malicious software to software developers and IT professionals. The organization infected at least 30000 devices in over 100 countries and withdrew funds or account credentials from over 7000 cryptocurrency wallets between December 2025 and July 2026, stealing at least $10.7 million.