Four Nations Unite Against North Korea-Backed Crypto Thief WaterPlum Group

Japan, the US, Australia, and Germany have attributed a global crypto-theft campaign to North Korea-backed WaterPlum Group, also known as Contagious Interview. The group has infected at least 30,000 machines across more than 100 countries, stolen around 7,000 wallet records, and moved approximately ¥1.7 billion ($11.5 million) in digital assets.

The joint advisory warns exchanges, wallets, and developers to harden their defenses and vet remote hires carefully. The group targets IT engineers with fake job offers, a technique tied to the Contagious Interview scheme, to deliver malware and drain crypto wallets.

Japanese police identified 'laptop farms' remotely operated by North Korean IT workers, which sent hundreds of millions of yen overseas, including crypto. A Japanese crypto exchange detected job applications from North Korean IT workers for engineer roles during interviews.

The joint announcement marks a rare, coordinated public naming of a North Korean cyber group by four governments and frames crypto theft as a national-security and economic threat rather than isolated crime.