North Korean Group WaterPlum Infects 30K Devices, Steals $10.7M in Crypto

This matters less as a headline heist than as a supply-chain warning: the entry point was developer machines, not exchange hot wallets, meaning the compromise sits upstream of the code and keys that crypto and AI projects depend on. The cross-border, high-volume nature of the campaign shows that recruitment-themed social engineering remains a cheap, scalable attack surface for state-linked actors. Whether such developer-targeted intrusions keep scaling, and how firms verify the recruiters and contractors they engage, is the open question worth tracking.