Japanese officials say North Korean hackers stole 7,000 crypto wallet records

Deceptive job offers conceal malicious payloads

Japanese officials say the North Korean hacking group WaterPlum infiltrated more than 30,000 devices across regions, exfiltrating data from over 7,000 cryptocurrency wallets between March and August 2026, primarily targeting software developers through deceptive recruitment drives and fake job offers.

The intrusion was discovered after security firms flagged suspicious recruitment emails. Investigators traced the malware to a command‑and‑control server linked to WaterPlum, a group previously tied to Pyongyang’s cyber‑espionage operations. The server hosted a custom payload that exfiltrated wallet files and system credentials. Authorities noted that the campaign ran for six months, from March to August 2026. The malware also attempted to steal login credentials for email and banking accounts, increasing the risk of identity theft.

WaterPlum sent fake job postings on freelance platforms, promising high‑paying development contracts. Recipients who clicked the links downloaded a trojan that harvested wallet credentials. A Japanese cybersecurity agency warned that the scheme puts thousands of traders at risk. Cybersecurity expert Kenji Tanaka said, „This is a textbook example of social engineering targeting developers.”

How can victims safeguard their assets?

Security analysts advise using hardware wallets and enabling two‑factor authentication on every account. Users must verify recruiter identities through official channels before sharing personal data. Regular reviews of transaction histories help spot unauthorized access early. Cybersecurity consultant Aiko Sato noted, „Simple habits can prevent major breaches.”

The breach could undermine confidence in digital asset platforms and attract further state‑sponsored attacks. Authorities plan to tighten network monitoring and impose stricter penalties for compromised devices. Ongoing investigations aim to trace the stolen wallet data and hold the perpetrators accountable. Analysts warn that repeated incidents may prompt stricter regulations across the crypto industry.

Frequently Asked Questions

How many devices were compromised? More than 30,000 devices were infected. The compromised machines spanned more than 100 countries and regions.

Which cryptocurrency wallets were affected? The breach exposed records from over 7,000 wallets, though the specific cryptocurrencies were not identified. The data included private keys and transaction histories. No public evidence shows funds were transferred.

What is the suspected motive behind the attack? Authorities believe the group seeks financial profit and intelligence on software development networks. The stolen data may be used to target high‑value crypto investors.