{"id":51495,"date":"2026-09-21T09:15:05","date_gmt":"2026-09-21T09:15:05","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=51495"},"modified":"2026-09-21T09:15:05","modified_gmt":"2026-09-21T09:15:05","slug":"north-korean-hackers-infect-30000-pcs-steal-10700000-in-crypto-through-fake-it-jobs-fbi","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=51495","title":{"rendered":"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI"},"content":{"rendered":"

\"\"<\/p>\n

A North Korean hacking group used fake IT job offers to infect at least 30,000 computers and move about $10.7 million in cryptocurrency back to the regime.<\/p>\n

The\u00a0warning<\/a>\u00a0comes from a joint advisory by the FBI, Japanese police, Australian cyber officials and German intelligence dated September 18th.<\/p>\n

The actor is called WaterPlum and is also known as Contagious Interview and Deceptive Development. It has been active worldwide since 2022.<\/p>\n

From December of 2025 through July of 2026 the group hit machines in more than 100 countries, including the United States, Japan and Europe, and pulled funds or credentials from more than 7,000 crypto wallets.<\/p>\n

It posts phony jobs on social media and recruiting sites, often posing as AI, crypto or NFT firms. Applicants are told to run coding tests or fix a fake video-call error. Those files load malware that watches the machine and steals passwords and wallet keys.<\/p>\n

The group hides some of that activity on GitHub and Ethereum.<\/p>\n

Says the advisory,<\/p>\n

\u201cThe primary goal of the actor is to plunder cryptocurrencies and gain access to financial accounts. To achieve this, the actor uses a combination of manipulation (social engineering) and malicious software disguised as legitimate development tools.\u201d<\/em><\/p>\n

Investigators say WaterPlum and North Korea\u2019s overseas IT workers likely sit under the 313 General Bureau of the Munitions Industry Department. Some of the same actors take remote jobs at foreign companies and send the pay home.<\/p>\n

The advisory says the operation is a short-term threat to people and companies in Germany and other EU states, and that the FBI is still chasing U.S. helpers who run laptop farms and bank accounts for those workers.<\/p>\n

Follow us on X<\/a>, Facebook<\/a> and Telegram<\/a><\/span><\/em>
\n
\nDon’t Miss a Beat \u2013 Subscribe<\/a> to get email alerts delivered directly to your inbox <\/span><\/em>
\n<\/p>\n

\n
<\/div>\n

&nbsp<\/p>\n

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.<\/h6>\n<\/div>\n

Generated Image: Midjourney<\/em><\/span><\/p>\n

The post North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI<\/a> appeared first on The Daily Hodl<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

A North Korean hacking group used fake IT job offers to infect at least 30,000 computers and move about $10.7 million in cryptocurrency back to the regime. The\u00a0warning\u00a0comes from a joint advisory by the FBI, Japanese police, Australian cyber officials and German intelligence dated September 18th. The actor is called WaterPlum and is also known […]<\/p>\n","protected":false},"author":1,"featured_media":51496,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"class_list":["post-51495","post","type-post","status-publish","format-standard","has-post-thumbnail"],"yoast_head":"\nNorth Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=51495\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"A North Korean hacking group used fake IT job offers to infect at least 30,000 computers and move about $10.7 million in cryptocurrency back to the regime. The\u00a0warning\u00a0comes from a joint advisory by the FBI, Japanese police, Australian cyber officials and German intelligence dated September 18th. The actor is called WaterPlum and is also known […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=51495\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-21T09:15:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dailyhodl.com\/wp-content\/uploads\/2025\/06\/dollar-print-flood.jpg?resize=1024,600\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI\",\"datePublished\":\"2026-09-21T09:15:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495\"},\"wordCount\":413,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/dollar-print-flood-9P7pNc.jpg\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495\",\"name\":\"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/dollar-print-flood-9P7pNc.jpg\",\"datePublished\":\"2026-09-21T09:15:05+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=51495\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/dollar-print-flood-9P7pNc.jpg\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/dollar-print-flood-9P7pNc.jpg\",\"width\":1024,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=51495#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=51495","og_locale":"en_US","og_type":"article","og_title":"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI - Cryptomag","og_description":"A North Korean hacking group used fake IT job offers to infect at least 30,000 computers and move about $10.7 million in cryptocurrency back to the regime. The\u00a0warning\u00a0comes from a joint advisory by the FBI, Japanese police, Australian cyber officials and German intelligence dated September 18th. The actor is called WaterPlum and is also known […]","og_url":"https:\/\/cryptomag.finance\/?p=51495","og_site_name":"Cryptomag","article_published_time":"2026-09-21T09:15:05+00:00","og_image":[{"url":"https:\/\/dailyhodl.com\/wp-content\/uploads\/2025\/06\/dollar-print-flood.jpg?resize=1024,600","type":"","width":"","height":""}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=51495#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=51495"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI","datePublished":"2026-09-21T09:15:05+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=51495"},"wordCount":413,"image":{"@id":"https:\/\/cryptomag.finance\/?p=51495#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/dollar-print-flood-9P7pNc.jpg","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=51495","url":"https:\/\/cryptomag.finance\/?p=51495","name":"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=51495#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=51495#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/dollar-print-flood-9P7pNc.jpg","datePublished":"2026-09-21T09:15:05+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=51495#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=51495"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=51495#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/dollar-print-flood-9P7pNc.jpg","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/dollar-print-flood-9P7pNc.jpg","width":1024,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=51495#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"North Korean Hackers Infect 30,000 PCs, Steal $10,700,000 in Crypto Through Fake IT Jobs: FBI"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/51495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=51495"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/51495\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/51496"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=51495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=51495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=51495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}