North Korean fake recruiters infect 30K devices, steal $10.7M in crypto
North Korean cyber group WaterPlum targeted developers with fake jobs at crypto, AI and NFT companies, infecting at least 30,000 devices across more than 100 countries.
Asanat Analysis — Why it matters
This campaign signals a maturation in state-sponsored crypto theft tactics. Rather than targeting exchanges directly, WaterPlum exploits supply-chain vulnerabilities by compromising developer devices—the keys to protocol security and private key management. The 30K device figure suggests operational scale comparable to earlier APT campaigns, but the crypto-specific targeting (fake roles at named companies) indicates threat actors now view the sector as a priority intelligence and funding source.
The $10.7M haul is modest relative to major DeFi exploits, but meaningful for operational budgets and geopolitical signaling. This attack class threatens not just individual wallets but the integrity of open-source libraries, GitHub commits, and build pipelines—infrastructure that underpins all downstream projects. Exchanges and protocols must now assume developer credential compromise as a baseline risk model, shifting security burden upstream.
Historically, North Korean cyber units have pivoted between ransomware, exchange hacks, and now targeted developer infiltration. This represents convergence with broader APT tradecraft: persistent access > bulk theft. For crypto teams, the lesson is that social engineering targeting technical staff requires equivalent controls to infrastructure security—background verification for recruits, hardware security keys, and code review processes that assume developer machines may be compromised.