North Korean hackers believed to be behind cryptocurrency thefts worldwide are linked to malware infections affecting at least 30,000 devices across more than 100 countries. The group, referred to as WaterPlum, compromises systems, enabling theft of digital assets.
Multiple outlets report a joint law enforcement advisory covering activity between December 2025 and July 2026. The advisory says WaterPlum infects victims’ devices with malware and transfers stolen cryptocurrency to North Korea. The scale of reported transfers exceeds $10.7 million, according to the advisory summarized by one outlet.
While one report emphasizes the global reach and includes Japan among affected countries, the other focuses on the measured scope of infections and the amount of cryptocurrency moved. Both accounts attribute the activity to the same North Korean hacking group and describe a coordinated pattern of compromise, theft, and transfer during the same period.
