A North Korean hacking group used fake IT job offers to infect at least 30,000 computers and move about $10.7 million in cryptocurrency back to the regime.
The warning comes from a joint advisory by the FBI, Japanese police, Australian cyber officials and German intelligence dated September 18th.
The actor is called WaterPlum and is also known as Contagious Interview and Deceptive Development. It has been active worldwide since 2022.
From December of 2025 through July of 2026 the group hit machines in more than 100 countries, including the United States, Japan and Europe, and pulled funds or credentials from more than 7,000 crypto wallets.
It posts phony jobs on social media and recruiting sites, often posing as AI, crypto or NFT firms. Applicants are told to run coding tests or fix a fake video-call error. Those files load malware that watches the machine and steals passwords and wallet keys.
The group hides some of that activity on GitHub and Ethereum.
Says the advisory,
“The primary goal of the actor is to plunder cryptocurrencies and gain access to financial accounts. To achieve this, the actor uses a combination of manipulation (social engineering) and malicious software disguised as legitimate development tools.”
Investigators say WaterPlum and North Korea’s overseas IT workers likely sit under the 313 General Bureau of the Munitions Industry Department. Some of the same actors take remote jobs at foreign companies and send the pay home.
The advisory says the operation is a short-term threat to people and companies in Germany and other EU states, and that the FBI is still chasing U.S. helpers who run laptop farms and bank accounts for those workers.
Follow us on X, Facebook and Telegram
Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
 
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
Generated Image: Midjourney
The post North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI appeared first on The Daily Hodl.
