North Korean Hackers Breach 30,000 Devices, Steal 7,000 Crypto Wallet Credentials
TREE NEWS reports: Japanese police have disclosed that a North Korean hacking group, tracked as WaterPlum, compromised more than 30,000 devices between 2025 and 2026, exfiltrating over 7,000 sets of cryptocurrency wallet information and seizing control of assets worth approximately $10.71 million. The investigation also uncovered, for the first time, a domestic “laptop farm” operation and suspected North Korean IT personnel who applied for positions at the Japanese exchange BitFlyer.
A Shift Toward Industrialized Credential Theft
The scale of the campaign marks a departure from the one-off exchange breaches that defined earlier North Korean crypto crime. Rather than targeting a single custodian, WaterPlum appears to have industrialized the theft of wallet credentials — infecting tens of thousands of endpoints to harvest seeds, private keys, and exchange logins at volume. That model is cheaper, harder to trace, and far more resilient than a single high-value heist.
The $10.71 million figure likely understates the true damage. Stolen credentials often sit dormant for months before being monetized, and victims may not realize their wallets were compromised until long after the intrusion. The 7,000 wallet datasets represent a pipeline of future thefts, not merely a past loss.
The Laptop Farm and the Insider Threat
Perhaps more consequential is the discovery of a “laptop farm” — a physical location hosting multiple machines used to mask the origin of remote IT workers — alongside evidence that suspected North Korean operatives applied for roles at BitFlyer. This is the classic playbook of infiltrating crypto firms through the hiring pipeline, obtaining legitimate access, and then abusing it.
For exchanges and DeFi protocols, the implication is blunt: perimeter security is no longer sufficient. Identity verification, endpoint monitoring, and behavioral analytics for remote staff are now core controls, not optional extras. A single compromised insider can bypass the technical defenses that took years to build.
What Comes Next
Expect Japanese and allied regulators to tighten rules around remote hiring in financial firms and to push for stronger device-level attestation. Crypto companies should assume that state-sponsored actors are already inside their applicant pools. The industry’s response — hardened identity checks, zero-trust access, and faster credential revocation — will determine whether the next WaterPlum campaign is a nuisance or a systemic event.
