A North Korea-linked cyber group posing as recruiters for crypto, AI, and NFT companies infected at least 30,000 devices across more than 100 countries and stole $10.7 million in crypto, according to Cointelegraph.
Disclaimer: News content is based on public news sources and provided for information only. It does not constitute investment advice.
The North Korean cyber group tracked as WaterPlum posed as recruiters offering jobs at cryptocurrency, artificial intelligence, and NFT companies, according to Cointelegraph. The campaign targeted software developers and used the promise of employment to deliver malware to their machines. At least 30,000 devices were infected, and the operation spread across more than 100 countries. The group is reported to have stolen $10.7 million in crypto assets. The combination of a trusted professional context — a job offer — with malicious code is what allowed the operation to reach such a broad set of victims.
Developers are attractive targets because their workstations often hold credentials for code repositories, cloud infrastructure, and, in the crypto sector, wallets and private keys. A single compromised laptop can therefore give an attacker access to systems and funds that are far more valuable than the device itself. The choice of crypto, AI, and NFT companies reflects the concentration of technical staff and digital assets in those industries. As a result, a recruitment-themed attack against developers can produce both direct financial theft and longer-term access to corporate networks. This is consistent with the broader pattern of North Korea-linked operations, which have repeatedly been associated with crypto-related theft in public attributions by blockchain analytics firms and governments.
More than 30,000 infected devices in over 100 countries indicates a campaign that was automated and broad rather than narrowly targeted. Such volume matters because each compromised machine can be used for further phishing, credential harvesting, or as a stepping stone into an employer's network. The cross-border nature also complicates law enforcement, since victims, infrastructure, and attackers may be in different jurisdictions. For the crypto, AI, and NFT firms named in the campaign, the practical risk is not only the $10.7 million reported stolen but also the exposure of internal systems. The broad spread suggests the operators were looking for volume, not a single high-value victim.
The $10.7 million figure reflects the attackers' preference for crypto assets, which can be transferred across borders quickly and without the intermediation of a traditional bank. Unlike a wire transfer, a crypto transaction cannot easily be reversed once confirmed, which reduces the victim's ability to recover funds. This characteristic has made crypto-related theft a persistent feature of North Korea-linked operations, according to public reports. The stolen funds are typically moved through multiple wallets and, in many cases, through mixing or exchange services to obscure their origin. For the targeted companies, the loss is both financial and reputational, because it involves corporate or customer assets held in digital form.
WaterPlum is the name used by security researchers for a North Korea-linked cyber group that reportedly carried out this campaign. According to Cointelegraph, the group posed as recruiters for crypto, AI, and NFT companies to target developers. The group is accused of infecting at least 30,000 devices and stealing $10.7 million in crypto.
The attackers presented themselves as recruiters offering jobs at cryptocurrency, AI, and NFT companies, which made their messages plausible to technical professionals. Developers who engaged with the offers were exposed to malware that infected their devices. The approach relies on the routine behavior of job seekers — opening attachments, following links, or running code as part of a hiring process.
These sectors employ large numbers of developers and handle digital assets that can be transferred and stolen remotely. Crypto in particular is attractive because transactions are difficult to reverse once confirmed. Targeting developers also gives attackers access to code repositories, cloud credentials, and internal systems, not just funds.
What the Campaign Involved
Why Developers Are a High-Value Target
Scale and Geographic Spread
The Role of Crypto in the Theft
What the Incident Signals for Employers and Security Teams
This article is rewritten from public news sources and further processed by AI. It is provided for information only and does not constitute investment advice — refer to the original source for the authoritative version.
The campaign shows that recruitment channels remain a reliable entry point for attackers, because candidates are expected to open documents, run code samples, or join video calls. Security teams at crypto, AI, and NFT companies may need to treat unsolicited recruiter contact as a potential threat vector, especially when it involves technical evaluations sent as files or links. Verification of recruiter identity, isolation of test environments, and monitoring of developer endpoints are standard mitigations that address this class of attack. Because the operators spread across more than 100 countries, no single region or company size should assume it is outside the target set. The incident also underlines that the cost of a compromise can far exceed the value of the stolen crypto, since network access itself is an asset.
The campaign infected at least 30,000 devices across more than 100 countries, according to the report. The attackers stole $10.7 million in crypto assets. The broad geographic spread suggests the operation was designed for volume rather than a single targeted theft.
Companies can verify the identity of recruiters, avoid running untrusted code on corporate machines, and use isolated environments for technical tests. Monitoring developer endpoints and limiting access to wallets and repositories also reduces the impact of a single compromised laptop. Because the attack uses a common business process, awareness among hiring teams matters as much as technical controls.
Individual developers were the initial point of contact, since the fake recruiters targeted them directly. A compromised personal device can become a route into an employer's systems if it is used for work. That is why both individuals and their employers need to treat unsolicited job offers with caution.
