North Korea's Waterplum crew turned fake tech job interviews into a harvesting machine: 30,000+ machines infected across 100+ countries, and $10.71 million in crypto funneled into Pyongyang-controlled wallets between late 2025 and July 2026. The bait was a coding test. The payload was a backdoor. And per the agencies, that money goes to the weapons program. You thought you were interviewing. You were the exit liquidity.
▪️ The setup: 'recruiters' from legit-sounding AI, blockchain and tech staffing firms slide into DMs — developers, web designers, crypto specialists, all fair game on job platforms and socials.
▪️ The hook: mid fake technical interview or coding assessment, you're told to download the test software or a video-call troubleshooting tool 'to proceed'. Sure. To proceed.
▪️ Run it and you're owned — backdoor trojans plus infostealers. No exotic zero-day, no genius exploit. Just you double-clicking their file on your own machine.
▪️ What they take: ID and passport scans plus crypto private keys. That's why it's wallets getting emptied, not just laptops getting bricked. Follow the incentives.
▪️ Domestic enablers faked location verification so North Korean IT workers landed real remote jobs at Japanese and US firms — those workers alone moved hundreds of millions of yen in crypto abroad.
▪️ Japanese police pulled a first: seized and dismantled a local laptop farm that let the operatives work off local IP addresses instead of Pyongyang's.
📊 Devices infected:
30,000+📊 Crypto wallets compromised:
7,000+📊 Countries hit:
100+📊 Campaign window:
late 2025 – July 2026This isn't abstract for you: 7,000 drained wallets means coins that already moved on-chain and got laundered into the exact same liquidity you trade against. The agencies' fix is boring and free — never execute unvetted code outside an isolated sandbox, and use workspace restriction controls before opening some random repo. And if a 'recruiter' asks you to install anything before the interview, that's not hiring, that's payload delivery.
🔮 Nobody cracked your wallet. You installed the malware yourself because you wanted the gig. That's the whole game.
@exverse_chat
