North Korean Hackers Pose as Recruiters, Infect 30K Devices and Steal $10.7M in Crypto

Overview

In a newly disclosed campaign, the North Korean hacking group WaterPlum masqueraded as legitimate recruiters targeting software developers interested in crypto, AI and NFT projects. By sending fabricated job offers that contained malicious links or attachments, the actors managed to compromise at least 30,000 endpoints spread across more than 100 countries. The operation resulted in the theft of approximately $10.7 million worth of various cryptocurrencies, highlighting the growing sophistication of state‑backed cybercrime.

How the Campaign Operated

The attackers created convincing profiles on professional networking sites and job boards, advertising positions such as “Senior Blockchain Engineer” or “AI Research Lead.” Once a candidate expressed interest, they were directed to download a seemingly innocuous software package or click a phishing link that deployed a multi‑stage malware payload. The malware harvested wallet private keys, seed phrases and exchange API credentials, then exfiltrated the data to command‑and‑control servers controlled by the Lazarus‑affiliated unit.

• Over 30,000 infected devices, spanning Windows, macOS and Linux systems.
• Targets included developers at exchanges, DeFi protocols, NFT marketplaces and AI startups.
• The stolen funds were moved through mixers and privacy coins to obfuscate the trail.
• Attribution was secured through code reuse, infrastructure overlaps and linguistic markers typical of WaterPlum.

Market Impact and Investor Sentiment

Although the total amount stolen is modest compared to the daily turnover of major crypto markets, the psychological effect can be outsized. News of state‑sponsored theft tends to erode confidence among retail participants, especially those who hold altcoins that are less liquid and more susceptible to sudden sell‑offs. In the immediate aftermath, several altcoin pairs exhibited heightened volatility and a mild bearish bias, while Bitcoin and Ethereum remained relatively stable due to their deeper order books.

Outlook and Recommendations

Going forward, firms involved in blockchain development should enforce stricter vetting of third‑party recruitment channels, employ hardware‑based wallet solutions, and conduct regular endpoint security audits. Regulators may also increase scrutiny on freelance platforms that facilitate cross‑border hiring, potentially leading to new compliance requirements. While the incident underscores the persistent threat posed by North Korean cyber units, the broader market is expected to absorb the shock without lasting damage to the leading cryptocurrencies.

Source: Cointelegraph