Key Takeaways:
- WaterPlum hacked over 30,000 devices in 100+ countries and accessed information from 7,000+ crypto wallets.
- Fake jobs, coding tests and malicious code targeted crypto, blockchain and Web3 developers.
- At least $1.8 million in tokens had been sent to WaterPlum’s wallets by Japanese authorities.
Japan’s National Police Agency (NPA) has exposed a large-scale cyber campaign targeting IT professionals, with cryptocurrency theft at the center of the operation. The investigation linked the WaterPlum group to activity associated with North Korean IT workers and uncovered infrastructure used to hide their identities and locations.
WaterPlum Turns Fake Jobs Into Crypto Theft
The NPA said the campaign would be initiated around December 2025 and end in July 2026. It was thought that more than 30,000 computers in over 100 countries and regions were infected.
The main targets included web developers and designers, as well as crypto and blockchain experts. WaterPlum allegedly reached out to victims through social media, recruitment sites, gigs and freelance marketplaces.
The attackers would frequently disguise themselves as trusted crypto, AI or NFT firms. Online Interviews were then followed, where candidates had to solve software problems and/or coding assignments.
Some applicants were given assignments to download files from development sites or code repos in lieu of a typical technical assignment. It is possible for those files to have malware that can compromise the victim’s machine.
Read More: Revolut Crypto Data Leak Exposes Bitcoin Records, Attackers Demand Payment to Stop More
Malware Went After Wallet Credentials
The NPA found multiple malware families associated with the attack: OtterCandy, OtterCookie, InvisibleFerret, BeaverTail and StoatWaffle.
If a system gets infected with the malware, it can grant persistent access in the system, and extract sensitive information from it. The catcher could grab browser cookies, clipboards, keystrokes, screenshots and files saved on the computer.
The biggest threats faced by crypto users were wallet credentials. According to the NPA, over 7,000 cryptocurrency wallet records were stolen. Private keys and seed phrases were among the information sought by the attackers.
The investigation also uncovered a minimum of ¥1.7 billion ($10.71 million RTW) of cryptocurrency moved to wallets operated by WaterPlum. This is an estimate of funds that have been identified by investigators, not an estimate of all potential losses.
North Korean IT Workers Add a Second Crypto Risk
The investigation also found another way to make money with Tech jobs. Japanese officials discovered and blocked a new “laptop farm” where computers were stored by a facilitator, and controlled remotely by North Koreans. Such machines could then be employed by workers to accept jobs and appear to be coming from Japan.
A minority also used stolen or mis-used identity papers and the use of VPS to mask the actual identities of the workers. Crypto and other assets valued at over hundreds of millions of yen have been sent abroad in incidents linked to the investigation, investigators said.
The NPA and the FBI concluded that the activities of WaterPlum and some North Korean IT workers were being directed by the Munitions Industry Department’s Bureau 313 of the Workers’ Party of Korea.
Read More: BonkDAO Hit by $20M Treasury Hack After Malicious Governance Proposal Rocks BONK Holders
