North Korean Hacker Group Behind Crypto Thefts Spanning 100+ Countries, Japan Says

Japan’s National Police Agency has identified a North Korean hacker group, known as WaterPlum, as responsible for a widespread cyberattack affecting more than 100 countries, including Japan. The campaign resulted in cryptocurrency theft valued at approximately 1.7 billion yen.

According to a joint warning document released Friday, the group infected over 30,000 devices with malware between December and July, stealing login credentials tied to roughly 7,000 crypto accounts. The report was signed by seven organizations across four countries, including Japan’s police agency and the US Federal Bureau of Investigation, as part of a coordinated effort to publicly identify state-linked cyber threats.

How the Scheme Worked

Investigators say WaterPlum operated by posing as corporate recruiters targeting IT professionals, sending malware disguised as technical assessment files to trick victims into exposing their crypto account credentials. Much of the stolen cryptocurrency, worth roughly 1.7 billion yen, was funneled into accounts controlled by the group.

Broader Pattern of North Korean Cyber Activity

The report also revealed that North Korean IT workers based in North Korea, China, and Russia have been earning foreign currency by taking remote programming jobs under false identities. This activity has reportedly funneled hundreds of millions of yen back to North Korea in recent years.

The findings highlight the growing scale and international reach of North Korean cyber operations targeting the crypto sector, as authorities across multiple countries continue working together to track and expose state-sponsored hacking networks.