A cyberattack by a group identified as North Korea's WaterPlum infected more than 30,000 devices and illicitly transferred cryptocurrency worth approximately ¥1.7 billion worldwide, including in Japan. The attacks occurred from December 2025 to July 2026 and are believed to have affected multiple countries.
The National Police Agency and the FBI said that a cyberattack carried out by WaterPlum, a group operating under the direction of North Korea, infected computers worldwide, spreading malware to at least 30,000 devices. It has been confirmed that cryptocurrency worth ¥1.7 billion was transferred to accounts controlled by the group.
The attackers approached people by posing as web designers and engineers seeking work, then sent files containing malware disguised as technical assignments designed to assess their skills. The malware extracted cryptocurrency account information from their devices. The stolen information was used to transfer funds to accounts controlled by WaterPlum.
A case also emerged in which a North Korean IT worker posed as a supporter based in Japan in an effort to earn foreign currency. The worker used an image of the supporter's identification document to obtain work, performed the assignments remotely and received payment. This is reportedly the first time authorities have identified a device in Japan used in this type of scheme, and they said overseas transfers in recent years have amounted to several hundred million yen.
In May 2025, a person believed to be a North Korean IT worker applied to the cryptocurrency exchange operator bitFlyer using a false résumé. The person was not hired, but reportedly refused to move to Japan and insisted on being paid in cryptocurrency. The National Police Agency said the methods are expected to continue evolving and will keep warning companies and IT professionals.