WaterPlum Turned Crypto Job Interviews Into a Malware Trap

North Korean hackers, a group known as WaterPlum, also tracked as Contagious Interview, stole approximately $10.7 million in cryptocurrency after infecting at least 30,000 devices by posing as recruiters for legitimate crypto, AI, and NFT companies.

The group targeted software developers and IT professionals worldwide, turning the ordinary hiring process into the initial point of compromise.

North Korean cyber group “WaterPlum” (aka “Contagious Interview”) is compromising job seekers’ computer networks, harvesting sensitive data, and stealing cryptocurrency. WaterPlum is targeting IT professionals in Japan, the United States, Europe, and beyond.

Posing as… pic.twitter.com/V9NKurMICb

— FBI Cyber Division (@FBICyberDiv) September 18, 2026

Don’t Miss: New Binance Listings That Could Erupt This Year

This Is How North Korean Hackers Infected 30,000 Devices and Stole $10.7M

The advisory says WaterPlum impersonated legitimate AI, cryptocurrency, and NFT companies, and in some cases used recruiting services directly, to approach victims through social media platforms, online job boards, gig-work platforms, and freelance marketplaces. Once contact was established, targets were guided through a recruitment process designed to look routine before the trap was sprung.

Victims were instructed by the North Korean hackers to download and execute files disguised as coding assignments or fixes for video-conferencing errors, according to the advisory. Those files served as the delivery mechanism for the malware behind the theft, which authorities say reached at least 30,000 devices and drained roughly $10.7 million in crypto assets from compromised users.

The advisory also connects WaterPlum to North Korea’s wider campaign of embedding IT workers inside foreign companies, with Japanese and US authorities assessing that WaterPlum actors and some North Korean IT workers operate under North Korea’s Munitions Industry Department.

That assessment places the fake-recruiter scheme alongside the more familiar reverse version of the scam, in which North Korean operatives secure real remote jobs and quietly funnel wages and stolen data back to the regime.

This is not the first time crypto security researchers have had to warn users about state-linked actors exploiting trust to reach wallets; a separate breach involving compromised wallet infrastructure underscored how quickly an attacker’s access converts into irreversible losses once credentials or keys are exposed.

Broader patterns of fraud and victim losses across the industry, including recent scam-prevention efforts tracked in Singapore, show regulators increasingly treating social-engineering schemes as a core crypto security threat rather than a peripheral nuisance.

Recruitment Workflows Became the Delivery Mechanism

The advisory targets individual web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies. This profile aligns perfectly with the freelance and remote-hiring economy that Web3 projects rely on to source technical talent. That dependency is precisely what made the scam effective: victims weren’t tricked by an obviously malicious link; they were walked through what looked like a normal technical interview before being asked to run code or troubleshoot a video call.

That sequencing matters. Developers are accustomed to cloning repositories, running test scripts, and installing conferencing patches daily. WaterPlum’s operators exploited this muscle memory rather than attempting to bypass conventional defenses.

Security researchers investigating the case suggest this developer-focused malware delivery method could serve as a template for other threat actors targeting Web3 and open-source ecosystems. However, this projection remains analyst commentary rather than a confirmed finding in the government advisory.

The pattern also reinforces a lesson already visible in other large-scale exploits this year: infrastructure that touches both developer tooling and custody of assets is a compounding risk. Coverage of infrastructure migrations tied to bridged assets and custody providers shows the industry is already moving to separate operational risk from asset custody. A design principle that recruitment-targeted malware campaigns like WaterPlum’s make newly urgent for individual developers and the firms that employ them.

WaterPlum’s $10.7 million haul is a reminder that the biggest threat to crypto holdings right now isn’t always a smart contract exploit – sometimes it’s a job offer.

Don’t Miss: New Binance Listings That Could Erupt This Year