North Korean Hacker Group WaterPlum Infects Over 30,000 Devices to Steal Information from 7,000 Cryptocurrency Wallets

The National Cyber Coordination Center of the Japanese National Police Agency, in collaboration with the FBI, the U.S. Department of Defense Cyber Crime Center, the Australian Cyber Security Centre, and the German Federal Intelligence Service, has issued a report stating that the North Korean hacker group WaterPlum primarily targets IT personnel. They conduct cyberattacks disguised as recruitment efforts to steal confidential information and cryptocurrency assets. The report indicates that from December 2025 to July 2026, the group infected over 30,000 terminals in more than 100 countries and regions, including Japan, stealing information from over 7,000 cryptocurrency wallets and transferring at least approximately 1.7 billion yen (about 10.71 million USD) in cryptocurrency assets to wallets under their control. The Japanese police seized and dismantled a "laptop farm" operated by local supporters for North Korean IT workers to control remotely. The police agency and the FBI assessed that WaterPlum and some North Korean IT workers are directed by the 313 Bureau of the Ministry of National Defense Industry of the Workers' Party of Korea. The group had previously disguised itself as applicants for engineering positions at the Japanese cryptocurrency exchange bitFlyer, but no actual employment or losses occurred.