North Korea-linked hacking group running fake-recruiter campaigns to steal cryptocurrency and compromise software developers.
North Korean fake IT workers are submitting as many as 60 job applications a day, ITPro reported from new research. Interviews are where these candidates succeed, so identity checks at hiring belong on the security team's list.
Reality
North Korea's WaterPlum stole $10.7 million in crypto from IT workers by posing as recruiters, infecting at least 30,000 devices. The FBI is investigating a separate ShinyHunters claim that agent data left its FBIjobs recruiting site.
Reality
Four governments have put a bureau name on the fake-recruiter campaign against software developers, and their alert says the same crews also work as North Korea's remote IT hires, from the same IP addresses.
Perspective Coverage
8 publishersReality
Bitget CEO Gracy Chen ties a $351 million breach of the exchange's online wallets to North Korean hackers and says a $464 million user fund covers it. Paying it out could leave about $113 million in reserve while withdrawals stay frozen and Bitget still cannot say how the attackers got in.
Reality
Japan, the US, Australia and Germany put eight months of North Korea's developer-targeting campaign at $10.71 million taken from more than 7,000 wallets. CertiK counted $2.06 billion of North Korea-linked crypto theft in 2025 alone.
Reality
Japan, Germany, Australia and the US say one North Korean group infected 30,000 devices in more than 100 countries to steal $10.7 million, a thin cash yield that points at the identity documents it also took.
Reality
A joint advisory ties about $10.71 million of stolen cryptocurrency to more than 30,000 infected devices in over 100 countries. That works out near $357 a machine, and the payroll half of the same operation ran for years.
Reality
Seven agencies across four countries tied fake recruiters and take-home coding tasks to eight months of infections and drained cryptocurrency wallets.
Reality