Fake Crypto Recruiters Infected 30,000 Devices and Reached 7,000 Wallets

By Isaac • September 20, 2026 11:19 pm •

The most dangerous part of this crypto theft campaign was not a clever wallet exploit. It was a job interview.

A joint international advisory says North Korea’s WaterPlum operation posed as legitimate employers, recruiters and technology companies to persuade developers to run malicious code. By the time investigators measured the damage, the campaign had infected at least 30,000 devices in more than 100 countries and reached more than 7,000 cryptocurrency wallets.

The reported theft totaled roughly 1.7 billion Japanese yen, equivalent to $10.71 million.

The numbers are serious. The method is worse, because it turns ordinary hiring steps—technical assignments, code repositories and video-call troubleshooting—into the initial attack surface.

The joint FBI and allied-agency advisory says WaterPlum