Japanese police, the FBI, and other partners have issued a warning about WaterPlum, a North Korean cybercrime group. Investigators link WaterPlum to hacks of roughly 30,000 devices and the compromise of more than 7,000 crypto wallets. Law enforcement estimates about ¥1.7 billion (around $10.71 million) in stolen digital assets were funneled to North Korea. WaterPlum is also believed to have ties to the 313 General Bureau of North Korea’s Department of Military Industry.

How WaterPlum Operates

According to law enforcement, WaterPlum’s playbook relies on fake “job interviews” and “test assignments.” Posing as recruiters or employers, the group connects with victims to gain access to their devices and crypto wallets.

Scope of Attacks and Damages

The group is linked to the compromise of over 7,000 crypto wallets and hacks of around 30,000 devices. Through these operations, WaterPlum moved about ¥1.7 billion in stolen digital assets—roughly $10.71 million—into North Korean hands.

Suspected Ties to North Korean State Agencies

Investigators point to WaterPlum’s connection with the 313 General Bureau of North Korea’s Department of Military Industry. This gives the case an international edge and highlights the organized, state-backed nature of the group’s operations.