Highlights

  • Japan's National Police Agency, alongside the US, Australia and Germany, jointly attributed a cyber campaign to the North Korean-linked group WaterPlum, also known as Contagious Interview.
  • The campaign infected more than 30,000 devices across over 100 countries between December 2025 and July 2026, targeting crypto, Web3 and IT professionals.
  • Attackers posed as recruiters offering jobs at AI, crypto and NFT companies, distributing malicious NPM packages during fake technical interviews.
  • Data was stolen from roughly 7,000 crypto wallets, with losses tied to the campaign estimated above $10 million.
  • Investigators separately dismantled a domestic "laptop farm" used by North Korean IT workers to disguise their location while working remotely for foreign employers.

Japan's National Police Agency, working with its National Cybersecurity Coordination Office, joined the United States, Australia and Germany this week in a formal public attribution naming WaterPlum, a North Korean state-linked hacking group also tracked under the alias Contagious Interview, as the actor behind a cyberattack campaign that infected more than 30,000 devices across upwards of 100 countries and regions between December 2025 and July 2026. The disclosure lands the same week Bitcoin's own breakout past $80,000 has pulled fresh capital and attention back into crypto, exactly the kind of high-interest moment state-linked hacking groups have historically used to their advantage.

WaterPlum isn't a new name to security researchers, but this is one of the more detailed public breakdowns of its operations to date. The group has been linked for several years to a broader constellation of North Korean state-sponsored hacking units that includes the better-known Lazarus Group, and it fits the same overall pattern: rather than attacking exchanges or protocols directly, it targets the people who work in and around crypto, treating social engineering as the more reliable path to funds that are otherwise protected by real cryptography. North Korea has leaned on this kind of operation for years as a workaround for international sanctions, and outside estimates have long put the regime's cumulative crypto theft in the billions of dollars, funneled back through a mix of state hacking units and disguised IT-worker schemes.

The attack's method leaned on social engineering rather than a technical exploit. WaterPlum operators posed as recruiters, dangling job offers at companies working in AI, cryptocurrency and NFTs, then used the interview process itself as the delivery mechanism: candidates were asked to run technical assessments or install packages that turned out to carry malware. Security researchers tracking the campaign have identified the malicious payloads as BeaverTail, InvisibleFerret and OtterCookie, distributed through compromised NPM packages. It is a supply-chain approach that lets the group reach developers and crypto-adjacent workers who'd otherwise be cautious about downloading software from an unknown source, since the packages arrive wrapped inside what looks like a legitimate hiring process.

The scale of the data theft is the clearest measure of how effective that approach was: roughly 7,000 crypto wallets had their data exposed, with losses tied to the campaign estimated at more than $10 million. Investigators separately uncovered and dismantled a domestic operation, described as a laptop farm, that let North Korean IT workers take remote jobs at foreign companies while disguising their actual location, a tactic North Korea has leaned on for years to funnel foreign-currency earnings back to the regime despite international sanctions.

What makes this disclosure notable is the joint framing itself. Japan's official announcement credits the Kanto Regional Police Bureau's Cyber Special Investigation Division and prefectural police forces, working from intelligence shared by private-sector security firms, and frames the four-country coordination as a deliberate move to strengthen international cooperation against state-sponsored cyber threats rather than a routine advisory from a single agency. Public attribution campaigns like this one are also a diplomatic tool as much as a security one. Naming a specific group and tying it to a specific state carries weight that a generic malware warning doesn't, and coordinating it across four governments signals this is being treated as an ongoing, shared threat rather than a one-off incident report.

For crypto and Web3 companies, the practical takeaway is narrower than the geopolitics: the entry point here was a fake hiring pipeline, not a smart contract bug or an exchange vulnerability. Verifying recruiter identities independently, running technical assessments in sandboxed environments, and treating unsolicited job outreach in the space with real skepticism would have blocked this specific campaign at its first step. With the attribution now public and the tactics documented, the open question is how quickly WaterPlum adapts its lure to route around the scrutiny this disclosure invites, a pattern that's played out before with other North Korea-linked groups once their methods became widely known.

FAQ

What is WaterPlum?
WaterPlum, also known as Contagious Interview, is a North Korean state-linked hacking group that Japan, the US, Australia and Germany jointly attributed this week to a campaign that infected over 30,000 devices and stole data from about 7,000 crypto wallets.

How did the hackers actually get in?
They posed as recruiters offering jobs at AI, crypto and NFT companies, then used the interview or technical-assessment stage to get candidates to run malicious NPM packages containing malware.

How much was stolen?
Losses tied to the campaign are estimated at more than $10 million, spread across roughly 7,000 affected crypto wallets in over 100 countries.