A North Korean hacker group known as WaterPlum compromised over 30,000 devices worldwide to steal cryptocurrency credentials, according to Japanese and U.S. authorities.
Key facts
- •The cyberattack affected more than 100 countries and resulted in the theft of roughly ¥1.7 billion in cryptocurrency.
- •Hackers compromised over 30,000 devices by tricking victims with fake job recruitment materials.
- •Japanese police dismantled a local support network that provided the hackers with servers and financial accounts.
- •North Korean IT workers used false identities to secure remote jobs in China, Russia, and North Korea to generate foreign currency.
- •The operation is linked to the 313 General Bureau of the Munitions Industry Department in North Korea.
A North Korean hacker group identified as WaterPlum has been linked to a global cyberattack spanning more than 100 countries, including Japan. Authorities report that the group infected over 30,000 devices with malware between late 2025 and July 2026 to steal credentials for approximately 7,000 cryptocurrency accounts.
By the numbers
Modus Operandi and Financial Impact
The hackers posed as corporate headhunters to recruit IT professionals, sending malware-infected files disguised as technical assessments. This operation resulted in the theft of approximately ¥1.7 billion in cryptocurrency, which was transferred to accounts controlled by the group. The National Police Agency and the FBI noted that the IP addresses used in these attacks matched those utilized by North Korean IT workers to secure remote programming jobs under false identities.
Network and Organizational Links
The investigation revealed that the operation was supported by individuals residing in Japan who provided servers, computers, and identification documents. Japanese police have since dismantled this support network. Authorities stated that both WaterPlum and the North Korean IT workers involved in these activities operate under the 313 General Bureau of the Munitions Industry Department, a body responsible for weapons development and IT strategy under the Workers Party of Korea.
Advertisement
This article was independently rewritten by ManyPress editorial AI from reporting originally published by The Japan Times, Nikkei Asia.
