North Korean Hackers Exploit Crypto Job Interviews, Stealing $11 Million
A global investigation has uncovered a sophisticated cyber-espionage campaign by North Korean actors, known as WaterPlum, who targeted Web3, blockchain, and software engineering professionals through fraudulent job interviews. The group successfully exfiltrated approximately $10.71 million to Pyongyang by distributing malicious files disguised as coding assessments.
The attackers utilized social media and freelance platforms, posing as recruiters for AI, NFT, and cryptocurrency firms. Malware families like BeaverTail and InvisibleFerret were employed to steal credentials and gain remote access, with a specific threat, StoatWaffle, embedded in blockchain-themed repositories. AI face-swapping and text-to-speech tools were used to mask their identities.
The advisory, signed by agencies from the U.S., Japan, Australia, and Germany, links WaterPlum to North Korea's 313 General Bureau, utilizing "laptop farms" to bypass geographical restrictions. This operation underscores the growing trend of targeted attacks on the digital asset industry, with North Korea-linked groups responsible for a significant portion of crypto theft losses. Web3 professionals are urged to exercise extreme vigilance during the hiring process.
https://cryptovka.com/news/north-korean-hackers-drain-11m-via-fraudulent-crypto-job-interviews
npub1kc…f0vwv
2026-09-23 12:17:11 UTC
Author Public Key
npub1kc6crlknw8nkcrnhe222s694duv3cwcxysxqypdlr6gf35kve3ysnf0vwvSeen on
wss://relay.damus.ioPublished at
2026-09-23 12:17:11 UTCEvent JSON
{
"id": "828f65ba03910e5d5b5334fbb9c3d0d1ca6f145c71454b23b8c6425db1f7631b",
"pubkey": "b63581fed371e76c0e77ca94a868b56f191c3b06240c0205bf1e9098d2cccc49",
"created_at": 1790165831,
"kind": 1,
"tags": [],
"content": "North Korean Hackers Exploit Crypto Job Interviews, Stealing $11 Million\n\nA global investigation has uncovered a sophisticated cyber-espionage campaign by North Korean actors, known as WaterPlum, who targeted Web3, blockchain, and software engineering professionals through fraudulent job interviews. The group successfully exfiltrated approximately $10.71 million to Pyongyang by distributing malicious files disguised as coding assessments.\n\nThe attackers utilized social media and freelance platforms, posing as recruiters for AI, NFT, and cryptocurrency firms. Malware families like BeaverTail and InvisibleFerret were employed to steal credentials and gain remote access, with a specific threat, StoatWaffle, embedded in blockchain-themed repositories. AI face-swapping and text-to-speech tools were used to mask their identities.\n\nThe advisory, signed by agencies from the U.S., Japan, Australia, and Germany, links WaterPlum to North Korea's 313 General Bureau, utilizing \"laptop farms\" to bypass geographical restrictions. This operation underscores the growing trend of targeted attacks on the digital asset industry, with North Korea-linked groups responsible for a significant portion of crypto theft losses. Web3 professionals are urged to exercise extreme vigilance during the hiring process.\n\nhttps://cryptovka.com/news/north-korean-hackers-drain-11m-via-fraudulent-crypto-job-interviews",
"sig": "071fb85a73cdabfac50b5c9facc8290ca3ea9c2d653da5df9321371138596576189a29e7bd30c47b5938cee9d6e7e81dd71d4c5428c1e58cea6cd4dfd1c25d33"
}