Japan's National Police Agency and the FBI reported that hackers linked to Pyongyang infected 30,000 devices across 100 countries between December 2025 and July 2026. The operation, attributed to the group WaterPlum, involved impersonating hiring managers at artificial intelligence, NFT, and crypto firms to trick applicants into installing malicious software on their hardware.

The campaign stole at least $10.71 million from 7,000 crypto wallets using the compromised devices. Japanese police also dismantled the first domestic laptop farm they identified as supporting North Korean IT workers, including one suspect who unsuccessfully applied for an engineering role at crypto exchange bitFlyer in May 2025.