North Korean hacker group WaterPlum disguises recruitment and steals $10.71 million in encrypted assets

The North Korean hacker group WaterPlum stole over 7000 encrypted wallet funds or credentials through disguised recruitment and transferred approximately $10.71 million to North Korea. The organization infected at least 30000 devices in over 100 countries between December 2025 and July 2026. WaterPlum impersonates AI, encryption, or NFT companies to induce developers to download files containing malicious software. Japanese law enforcement agencies have destroyed a laptop farm within the country and discovered that hundreds of millions of yen in encrypted assets have been transferred overseas. The investigation suggests that WaterPlum and some remote IT personnel from North Korea are both under the jurisdiction of the 313 General Administration of the North Korean Ministry of Supply Industry. (Source: Decrypt)