WaterPlum North Korean Hackers Steal $11M Crypto From 30,000 Devices Posing as Tech Recruiters
The overlap between WaterPlum and North Korean IT worker networks signals a deliberate operational architecture: the job-seeker targeting route generates revenue and collects HUMINT on target organizations, while the IT contractor route places operatives inside foreign corporate networks with plausible cover and legitimate network access. This two-channel model suggests North Korea is not simply funding nuclear programs through crypto theft — it is positioning operatives for deeper penetration.
North Korea just demonstrated a hybrid revenue model — WaterPlum extracts $11M in tradeable cryptocurrency while simultaneously operating as paid IT contractors for foreign clients, creating a dual-income stream that sanctions cannot easily interdict.
The 30,000-device footprint across 100 countries means the group has direct access to source code repositories, corporate credentials, and development infrastructure at scale, which translates into supply-chain reconnaissance capability for future espionage or sabotage operations. Japanese authorities dismantled a domestic laptop farm and recovered evidence of several hundred million yen in crypto transfers, but the alert emphasizes ongoing difficulty: the group operates across jurisdictions and uses cloud services that obscure its infrastructure, forcing law enforcement to chase enablers rather than the group itself.
How many of the 30,000 compromised devices belong to defense contractors, aerospace firms, or government agencies? The alert names IT professionals broadly but does not specify whether critical infrastructure or classified-adjacent networks were targeted.
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.