North Korean fake interviews drain $11 million from 7,000 wallets

A North Korean crew posing as recruiters took funds or credentials from more than 7,000 cryptocurrency wallets. The crew moved around $10.71 million to Pyongyang. Seven agencies across four countries issued a joint advisory on September 18. Japan's National Police Agency calls the group WaterPlum. The security industry calls it Contagious Interview. The group infected at least 30,000 devices in more than 100 countries between roughly December 2025 and July 2026. Its targets included web designers, engineers, and specialists in crypto, blockchain, and Web3 work. The advisory was signed by agencies from Japan, the United States, Australia, and Germany. The National Police Agency and the FBI assess that WaterPlum and some North Korean remote IT workers report to the 313 General Bureau of the Munitions Industry Department. The agencies treated shared IP addresses and similar use of laptop farms, crowdsourcing services, and job applications as evidence that the operations are one group. The actors posed as AI, crypto, or NFT companies. They contacted developers through social media, job boards, and freelance marketplaces. They then arranged technical interviews or coding tasks. Candidates were asked to download files from developer platforms to complete assignments or fix an apparent video-call problem. The advisory names five malware families in those packages, including BeaverTail, InvisibleFerret, and StoatWaffle. StoatWaffle hides in blockchain-themed repositories. Members used AI face-swapping software during interviews. They cut the video and asked candidates to do the same while blaming the connection. They also practised Japanese pronunciation with text-to-speech tools. Japanese authorities dismantled a domestic laptop farm for the first time in the country. They found evidence that several hundred million yen in cryptocurrency had moved abroad. A Japanese crypto exchange rejected an applicant in May 2025 after finding implausibly broad skills on the résumé and a mismatch involving English. Other warning signs included refusing in-person meetings, requesting payment in crypto, and repeatedly looking at a second screen. CertiK attributed 60% of all crypto theft losses in 2025 to North Korea-linked groups. Those losses amounted to some $2.06 billion. Attackers also posed as a quantitative trading firm before the Drift Protocol hack in April, which involved $285 million.