North Korean fake recruiters stole $10.7M from job seekers

North Korean hacking group WaterPlum stole at least $10.7 million by posing as recruiters for legitimate crypto and AI companies, infecting at least 30,000 devices across more than 100 countries, a joint advisory from Japan, Germany, Australia and the United States said. Primary targets were individual web designers, engineers and specialists in cryptocurrency, blockchain and Web3.

The group, also tracked as Contagious Interview, reaches its victims through social media, online job platforms, gig work sites and freelance marketplaces.

How the recruiter lure works

WaterPlum contacted candidates through four main channels: social media, online job platforms, gig work sites and freelance marketplaces. The fake recruiters also impersonated non-fungible token (NFT) companies and used recruiting services to look credible.

Candidates were walked through standard recruiting steps, then told to download and run files disguised as coding assignments or as fixes for video-conferencing errors. Those files installed remote-access trojans and infostealing malware, which the attackers used to pull sensitive data and cryptocurrency from the infected machines.

Once inside a developer device, WaterPlum had a backdoor into that developer's employer. Successful infections also create opportunities for WaterPlum actors to infiltrate organizations that employ the unsuspecting developers, the advisory said.

What the $10.7M actually looks like

The advisory's bottom line: funds or account credentials were extracted from more than 7,000 cryptocurrency wallets between December 2025 and July 2026. The publicly reported figures stop there. The four governments' summary does not break out which chains the drained wallets sat on, and the on-chain movement patterns behind the $10.7 million figure are not detailed in the public reporting this article is based on.

For a candidate, the practical risk runs beyond drained wallets. Stolen identity documents allow North Korean IT workers to impersonate victims and earn income, and the sensitive information taken from infected machines can be used for extortion.

Red flags a job seeker can actually use

The advisory described a case in which a suspected North Korean IT worker applied for an engineering role at a Japanese crypto exchange using a forged resume. The exchange rejected the applicant after interview discrepancies, including an inability to explain the skills listed in his resume in detail.

A second case, reported separately in July, saw Consensys unknowingly engage a North Korea-linked developer as a consultant. The company told Cointelegraph it terminated their access after discovering the threat. Consensys's investigation found no theft of assets or data, no malicious code deployment and no impact on user safety.

The pattern: candidates who cannot walk through their own listed experience, and recruiters who push downloads or fixes before any human conversation, are the two clearest signals.

The wider North Korea operation

WaterPlum is one thread in a larger North Korean effort. Japanese and US authorities assess that WaterPlum actors and some North Korean IT workers operate under North Korea's Munitions Industry Department. US authorities have warned about North Korea's undercover IT workers since at least 2018.

The scale of the wider campaign is the reason the recruiter playbook matters. The FBI blamed North Korea for the $1.5 billion Bybit theft in February 2025, and the same state-backed tradecraft now reaches individual developers through a job offer.