The North Korean cyber group WaterPlum infected at least 30,000 devices across more than 100 countries between roughly December 2025 and July 2026, targeting web designers, engineers and specialists working in crypto, blockchain and Web3. A joint advisory published on September 18 by seven agencies from Japan, the United States, Australia and Germany said the group took funds or credentials from more than 7,000 cryptocurrency wallets and moved ¥1.7 billion, or about $10.71 million, to North Korea. Japan’s National Police Agency calls the group WaterPlum, while the security industry knows it as Contagious Interview. Investigators said attackers posed as recruiters for AI, crypto or NFT companies, then used interviews and coding assignments to deliver malware including BeaverTail, InvisibleFerret and StoatWaffle. Japanese authorities also dismantled a domestic laptop farm (remotely operated work computers) for the first time, finding evidence that several hundred million yen in crypto had moved abroad. The NPA and FBI assessed that WaterPlum and some North Korean remote IT workers report to the 313 General Bureau of the Munitions Industry Department under the Workers’ Party central committee. The activity forms part of a broader campaign that CertiK attributed to North Korea-linked groups for 60% of crypto theft losses in 2025, or some $2.06 billion.