The FBI and Japan's National Police Agency identified a malware campaign by the North Korea-linked group WaterPlum that infected more than 30,000 devices across 100 countries and regions from December 2025 to July 2026. By impersonating recruiters for AI, NFT and cryptocurrency firms, the hackers compromised more than 7,000 crypto wallets and stole at least $10.71 million.

Japanese police dismantled the first identified domestic laptop farm supporting North Korean IT workers during the investigation. The group targeted engineers with fake job offers and programming challenges that required installing malware to harvest wallet credentials.

A suspected North Korean IT worker unsuccessfully applied for an engineering position at the bitFlyer crypto exchange in May 2025. The WaterPlum operation focused on social engineering to bypass self-custody security, shifting from large exchange heists toward volume theft from individual users to accumulate assets.