Japan, the US, Australia, and Germany Named One Fake-Recruiter Crew. It Drained 7,000 Wallets

What Happened

On Friday, September 18, 2026, 7 agencies across 4 countries published a joint advisory on a North Korea-linked intrusion campaign tracked as WaterPlum, also known in industry reporting as Contagious Interview. The issuing bodies are Japan's National Police Agency and its National Cyber Coordination Office, the United States Federal Bureau of Investigation and the Department of Defense Cyber Crime Center, the Australian Signals Directorate's cyber security centre, and Germany's Federal Intelligence Service and Federal Office for the Protection of the Constitution.

The advisory attributes the campaign to the 313 General Bureau of the Munitions Industry Department, a North Korean state body, on the basis of shared operational infrastructure including overlapping IP addresses. Attribution at this level of specificity, co-signed by 4 governments, is a stronger claim than the probabilistic language security vendors usually use.

The reported scope covers December 2025 through July 2026: at least 30,000 devices compromised, victims in more than 100 countries, credentials or funds taken from more than 7,000 cryptocurrency wallets, and approximately 1.7 billion yen, about $10.7 million, moved into wallets under the group's control.

The method is a hiring funnel rather than an exploit chain. Operators present themselves as recruiters for artificial intelligence, cryptocurrency, blockchain and Web3 companies, approach engineers, web designers and specialists, and carry the conversation to an interview stage.

There the candidate is asked to download a file or run code, framed as a coding assessment or as a fix for a videoconferencing problem. The malicious payload is the task itself, which is why no software vulnerability is required and why the victim's own diligence works against them.

Japan also dismantled what reporting describes as its first North Korean laptop farm, a facility supporting the wider scheme, which marks a shift from advisories alone to physical enforcement.

About $1,500 a wallet, 7,000 times over, from people who build the software everyone else runs. The money was never the objective, and your hardware wallet was never the thing they were aiming at.

Divide 10.7 Million by 7,000

The arithmetic is the most informative thing in the advisory, and it is arithmetic the advisory does not do for you. Roughly $10.7 million spread across more than 7,000 wallets is about $1,500 per wallet. Set that against the same state's other results: $1.5 billion from Bybit, and the roughly $6.

75 billion cumulative lower-bound estimate from Chainalysis. A crew capable of 9-figure exchange intrusions did not spend 8 months collecting $1,500 at a time because that was the goal. The wallet sweeping is what you do with access you already have, on the way to something else.

What the access is for follows from who was targeted. These are engineers and designers at artificial intelligence, cryptocurrency and Web3 companies, which is to say people with commit rights, cloud credentials, internal documentation, and signing keys for software other people run.

An implant on that machine drains the personal wallet in the browser and also inherits the victim's position inside their employer. The archive has the same pattern at both ends of the scale: Lazarus reached Bitrefill through 1 compromised laptop in March, the Drift intrusion in April began with months of in-person social engineering before any code ran, and a 3-of-6 multisig collapsed in June because the quorum that was supposed to be distributed turned out to live on 1 machine.

Personnel are the attack surface, and 30,000 of them is a pipeline rather than a campaign.

Why This Is Statecraft and Not Just Crime

The fifth-generation framing earns itself here, though it is worth being careful about why. This is not warfare because the losses are large; by state-budget standards $10.7 million is trivial. It is statecraft because a sanctioned government is running a talent-acquisition funnel as an intelligence and revenue pipeline simultaneously, at a scale that only makes sense if the same operation serves both.

The laptop farm Japan dismantled is the other half of the same machine: North Korean operators placed inside foreign companies as remote employees, earning salaries and holding access. The fake recruiter and the fake employee are 2 directions of 1 strategy for a state cut off from the banking system, and cryptocurrency is the settlement layer that makes both fundable.

The honest counter-argument is that most of this is ordinary criminal tradecraft with a flag on it. Fake job offers carrying malware predate North Korea's interest in them by decades, the tooling is not exotic, and calling every state-linked theft a form of warfare drains the word of meaning.

That is fair, and the advisory's own contents support it: nothing here required a novel exploit. The distinction worth keeping is the target set. Ordinary criminals go where the money is; this campaign went where the access is and took the money on the way past. That is an intelligence-collection shape with a revenue side effect, and treating it as only theft will lead defenders to protect the wrong asset.

What This Means for You

Name the limit first, because it is the whole lesson. A hardware wallet protects your private keys from a compromised computer. It does not protect the computer, it does not protect your employer, and it does not protect the browser session, the password manager, the cloud console, or the repository you have write access to.

For the roughly 7,000 wallets in this advisory, the keys were reachable from the machine, which means they were in software. That part is solvable and the rest is not solved by any wallet purchase.

If you work in this industry, assume you are inside the target set and change 2 things this week. First, stop running unfamiliar code on the machine that holds anything. A disposable virtual machine, a separate laptop, or a cloud sandbox costs almost nothing, and the entire campaign described here depends on the candidate executing the file on their daily driver.

Treat a take-home assessment, an SDK you were asked to debug, or a meeting plugin that needs installing as untrusted by default, no matter how legitimate the company looks, because the company usually is legitimate and the recruiter is not. Second, separate the accumulation from the operating.

Long-term savings belong on a hardware device whose seed has never touched the machine you work on, with a balance you do not spend from; the hot wallet you use for testing should hold an amount you would shrug at losing.

Then extend it past your own keys, because the advisory is really about your employer. If you hold privileged access at work, your personal security posture is a corporate control whether anyone has told you that or not. Ask whether production signing keys require a hardware token you physically hold, whether your commit access can be exercised from a compromised laptop without a second factor you would notice, and whether anyone would detect an implant on your machine before it reached the repository.

The individual holder's version of this is simpler: your keys are as safe as the least careful thing you have ever done on the device near them, and in this campaign the least careful thing was accepting an interview.

What to Watch

The advisory's indicators are the immediate operational value, so the first checkpoint is whether the participating agencies publish the technical appendix with hashes and infrastructure rather than only the narrative. Whether other governments join the attribution will show if the 313 General Bureau finding is broadly held or rests on 1 partner's collection.

On the enforcement side, Japan's laptop-farm action is the precedent to track: further physical dismantlement in other jurisdictions would mean the remote-worker half of the scheme is now being worked as well. And the number to revisit is the per-wallet average, because if a future tranche shows the same device count with a far larger haul, the campaign will have shifted from collecting access to cashing it.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.