The FBI and Japan's National Police Agency uncovered a global malware network that compromised more than 30,000 devices between December 2025 and July 2026. The North Korea-linked group WaterPlum stole at least $10.71 million from more than 7,000 crypto wallets by impersonating recruiters from crypto, AI, and NFT firms to trick job seekers into installing malware. The campaign targeted individuals across more than 100 countries, utilizing fake programming challenges to bypass security assumptions of self-custody wallets.

Japanese authorities dismantled the first identified domestic laptop farm used to support North Korean IT workers during the investigation. One suspected operative unsuccessfully applied for an engineering role at the crypto exchange bitFlyer in May 2025. The group focused on social engineering to obtain private credentials rather than using protocol exploits, making the volume of individual thefts harder to stop than large exchange heists.