Japan, Germany, Australia, and the United States have issued a joint warning over a North Korean cyber group identified as WaterPlum, also known as Contagious Interview. The governments said the group posed as recruiters from cryptocurrency, AI, and NFT companies and, between December 2025 and July 2026, stole at least $10.7 million from more than 7,000 crypto wallets while infecting over 30,000 devices.
According to the warning, the operation targeted developers through social media and recruiting platforms, luring them into downloading malicious files. Once the malware established backdoor access, the attackers were able to steal cryptocurrency and sensitive data from compromised systems.
U.S. and Japanese authorities assessed that WaterPlum is linked to North Korea’s Ministry of Munitions Industry. They also said the campaign is connected to a broader effort involving North Korean IT workers dispatched to overseas companies. The report follows a separate case in July, when Consensys ended a working relationship after discovering North Korea-linked developers had been hired, though the company found no asset losses in that incident.
Japan, Germany, Australia, and the United States have issued a joint warning saying a North Korean cyber group known as WaterPlum, also called Contagious Interview, posed as recruiters from cryptocurrency, AI, and NFT companies and stole at least $10.7 million from more than 7,000 crypto wallets between December 2025 and July 2026. The warning said the campaign also infected more than 30,000 devices.
According to the notice, the group used social media and recruiting platforms to trick developers into downloading malicious files. After gaining backdoor access, the attackers stole cryptocurrency and sensitive data.
U.S. and Japanese authorities assessed that WaterPlum is linked to North Korea’s Ministry of Munitions Industry. They said the activity is also tied to a broader operation involving North Korean IT workers dispatched to overseas companies.
In July this year, Consensys ended a working relationship after hiring developers linked to North Korea, but found no asset losses, according to Cointelegraph.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
