North Korea used fake job interviews to steal nearly $11 million from over 7,000 crypto wallets. A cyberattack campaign allegedly linked to North Korea stole funds or access credentials from more than 7,000 cryptocurrency wallets, transferring approximately 1.7 billion yen—equivalent to $10.71 million—back to North Korea. This information was disclosed in a joint alert issued by seven security and intelligence agencies from Japan, the United States, Australia, and Germany. The group is referred to as WaterPlum by Japan’s National Police Agency and is commonly known in cybersecurity circles as Contagious Interview. Between December 2025 and July 2026, the campaign infected at least 30,000 devices across more than 100 countries, primarily targeting developers, engineers, and personnel in the crypto, blockchain, and Web3 sectors. The common tactic involved impersonating AI, crypto, or NFT companies, reaching out to candidates via social media and job platforms, and conducting technical interviews. Victims were then asked to download files for a coding test or to “fix” a video call—but these packages contained malware such as BeaverTail, InvisibleFerret, and StoatWaffle. Investigators also found that the group used AI-powered face-swapping technology during interviews and operated “laptop farms” to conceal the real locations of North Korean personnel. Japan reported dismantling one such laptop farm within its borders—the first confirmed case of its kind in the country. The FBI and Japanese authorities assess that WaterPlum and several of North Korea’s remote IT labor networks are connected to the same agency within the country’s defense industrial system, suggesting that fake recruitment and crypto theft may be part of a coordinated, state-sponsored campaign.