朝鲜黑客组织WaterPlum伪装招聘，窃取逾7000个加密钱包1071万美元

Theo Odaily, the North Korean hacking group WaterPlum obtained funds or credentials from over 7,000 crypto wallets by disguising its recruitment process, and transferred approximately $10.71 million to North Korea. Between December 2025 and July 2026, the group infected at least 30,000 devices across more than 100 countries.

WaterPlum impersonated AI, crypto, or NFT companies and approached developers through social media, recruitment platforms, and freelance platforms, luring them into downloading files containing malware under the guise of technical interviews or coding tasks. Targets included web designers, engineers, and practitioners in the crypto, blockchain, and Web3 sectors.

Japanese law enforcement dismantled a "laptop farm" within the country for the first time, discovering that hundreds of millions of yen in crypto assets had already been transferred overseas. The investigation believes that WaterPlum and some North Korean remote IT workers both belong to the 313th General Bureau of North Korea's Munitions Industry Department, and share IP addresses used to access the laptop farm and job-seeking services. (Decrypt)