North Korean Hackers Drain 7,000 Crypto Wallets: What to Check on Job Offers and Coding Tests

Seven agencies from four countries published a joint advisory on September 18, 2026, and it carries a finding that matters to anyone who holds their own keys: a North Korean threat group has used fake job offers to infect at least 30,000 machines in more than 100 countries, draining balances or credentials from over 7,000 crypto wallets. The signatories include Japan's National Police Agency and the FBI, alongside Germany's foreign intelligence service, the Bundesnachrichtendienst, and its domestic security agency, the Bundesamt für Verfassungsschutz.

The short answer to what you should do about it fits in a single sentence: keep the machine on which you run other people's code strictly separate from the machine that holds your keys. The rest of this article explains why that particular separation works, which malware families the agencies name, and how to spot the bait before you open anything.

What the joint advisory of September 18, 2026 establishes

The agencies track the group under the name “WaterPlum”. In the security industry the same group usually goes by “Contagious Interview”, named after its method: the job interview that infects. This advisory carries more weight than a single vendor's assessment, because it is a coordinated finding by seven state bodies.

The signatories are Japan's National Police Agency, Japan's National Cybersecurity Office, the FBI, the US Department of Defense Cyber Crime Center, the Australian Cyber Security Centre of the Australian Signals Directorate and, from Germany, the Bundesnachrichtendienst and the Bundesamt für Verfassungsschutz. Two German services co-signing is the reason this warning does not stay on the other side of the world: the agencies explicitly count victims in Europe too.

The figures in the advisory cover the period from roughly December 2025 to July 2026. Across those eight months or so, the NPA established that at least 30,000 PCs in more than 100 countries were compromised. Balances or credentials flowed out of more than 7,000 crypto wallets. The agencies put that outflow at a minimum of 1.7 billion Japanese yen, or 10.71 million US dollars. On the matching assessment of the NPA and the FBI, the group and a share of North Korea's IT workers report to the 313th General Bureau of the Munitions Industry Department at the Central Committee of the Workers' Party of Korea.

Measured against the large exchange breaches of recent years, the sum is small. It is spread across more than 7,000 individual victims, though, and that is where the difference lies. Companies carry insurance and reserves; here the losses land on private individuals, and nobody reimburses them. For scale: Bitcoin traded at around $81,500 on September 19, 2026 at 18:45 UTC, according to CoinGecko. The drained sum therefore amounts to roughly 130 Bitcoin.

WaterPlum and “Contagious Interview”: how the attack runs through the coding test

It does not start with a flaw in your wallet. It starts with a friendly message. The actors pose as recruiters and do so in the name of real companies working in artificial intelligence, cryptocurrencies and NFTs. They approach developers directly through social networks, job boards, gig platforms and freelancer marketplaces.

The entry point: the supposed application

Anyone who replies goes through a hiring process that looks entirely normal at first. There is a CV review, a video call, friendly feedback. The agencies describe the actors using AI-assisted face-swapping software for some of these calls. After a few minutes they switch off their camera and ask the other side to do the same, citing alleged connection problems.

The moment the malware starts

Somewhere in the process, the actors call for a technical interview or a programming task. They ask candidates to download and execute files hosted on common developer platforms and code repositories. The pretext sounds harmless: either the file belongs to the assignment, or it is meant to fix a supposed bug in the video conferencing tool. The instant that code runs, the device is open.

BeaverTail, InvisibleFerret and OtterCookie: the malware the agencies name

The advisory names five malware families found inside manipulated packages on the NPM package manager. NPM is the standard package manager for the Node.js JavaScript runtime, the route through which developers pull in third-party code libraries.

BeaverTail is malware written in JavaScript and hidden inside NPM packages. InvisibleFerret is a Python-based backdoor into the victim's machine. OtterCookie is a remote access trojan that harvests data at the same time. OtterCandy combines its functions with a further malware family. StoatWaffle, finally, is a modular Node.js strain that rolls loader, credential stealer and remote access trojan into one.

StoatWaffle deserves particular attention because it uses a route almost nobody considers. It disguises itself as a project folder with a blockchain theme and places a manipulated configuration file for the Visual Studio Code editor inside it. As soon as the folder is opened and marked as trusted, the code starts on its own. Opening a folder is enough; nobody has to deliberately run a program.

After the initial access, the attackers hold the connection open through remote access trojans, harvest data with dedicated software and forward it to a command address on the network from which they manage the infected devices.

Seed phrase and browser passwords: what the attackers actually take

The agencies list what the actors are after, and the list reaches well beyond wallet files. They take credentials stored in the browser, meaning usernames and passwords. Added to that are the contents of the clipboard, recorded keystrokes and screenshots.

For crypto holders the decisive item comes next: wallet data including private keys and the seed phrase. The seed phrase is the sequence of usually twelve or twenty-four words from which every key in a wallet can be restored. Whoever holds it holds the coins, regardless of the device the wallet originally ran on.

On top of that come arbitrary files of interest, explicitly including photographs of identity documents such as driving licences and passports. Those images are no accidental catch. The agencies describe stolen identity documents being used afterwards to impersonate the victim and take on contract work under their name. The damage does not end with the balance.

Why the scheme also hits holders who have no developer job

At first glance the warning looks like a developer problem. The NPA names web designers, engineers and specialists in cryptocurrencies, blockchain and Web3 as the primary targets. Anyone who never writes a line of code might file the whole thing away on that basis.

That falls short, for two reasons. The first is the breadth of the term: the target group explicitly includes freelance web workers. In Germany alone that means tens of thousands of self-employed people who take on projects through international platforms and frequently use the very device their wallet sits on.

The second reason carries more weight. The attackers do not stop at the individual machine. The agencies describe a successful infection opening the path into the organisation the victim works for. From there, trade secrets, credentials and crypto assets belonging to employers, clients and contractual partners are siphoned off. If your service provider is compromised, you are affected without ever having written an application.

This indirect chain is the same one that runs through compromised interfaces. Anyone working with exchange programming interfaces should therefore check regularly what permissions their own API keys really carry.

Running other people's code: how to open a test assignment safely

The agencies give a clear recommendation, and they phrase it in deliberately absolute terms: do not run code from unknown third parties on a machine that manages crypto assets or personal data. Unknown code belongs exclusively in a sandbox or a virtual machine. A virtual machine is a walled-off computer inside your computer; what happens in it never reaches your actual system.

Before execution, the agencies also advise checking the code for obfuscated or unreadable sections. Where a hiring assignment contains character strings nobody can read, the assignment itself is the attack.

For your coins this leads back to the separation set out above: keys belong on a device on which foreign code never runs. A hardware wallet solves this most rigorously, because the private key never leaves the device and every transaction has to be confirmed there. Our hardware wallet comparison shows how the models differ.

The character strings the agencies single out

The advisory names specific command components that call for particular caution. It lists “curl”, “base64”, “-enc”, “mshta”, “iwr-uri” and “hidden”. If they show up in a script someone sends you during a hiring process, do not execute it until you fully understand its behaviour. These building blocks typically fetch further code, obfuscate it or launch it invisibly.

Visual Studio Code in restricted mode: the switch against the auto-start

Against StoatWaffle the agencies name a very concrete countermeasure. Do not open unknown projects in the Visual Studio Code editor at all, or open them exclusively in restricted mode. That mode prevents commands from the file “.vscode/tasks.json” being executed on launch.

You reach the mode through the prompt asking whether you trust the authors of the files in this folder. Answer no there and you stay in restricted mode. You can then inspect the file “.vscode/tasks.json” at your leisure for anything that downloads or launches further files. The agencies' closing point on this matters: never open unknown projects from a folder or path you once marked as trusted. Otherwise the trust decision still applies and nobody is asked again.

Laptop farms and North Korean IT workers: why clients need to pay attention

The second part of the advisory deals with a practice that concerns European companies and clients directly. North Korean IT workers get themselves hired for projects under false identities and work through what are known as laptop farms. These are locations, often the private homes of facilitators, where the company machines physically sit and are controlled remotely from abroad. Japanese authorities say they have identified and dismantled such a farm for the first time.

For clients, the advisory contains a sentence with considerable reach: paying remuneration to North Korean IT workers, or supporting their foreign currency procurement, can breach national law and sanctions against North Korea. Anyone awarding contracts should therefore also look at subcontractors and establish contractually who actually performs the work.

A related scheme shows how quickly someone can end up in a criminally relevant role without intending to: in crypto job offers where your own bank account is supposed to process other people's payments, money laundering already begins with negligence.

Suspected infection: the order in which to proceed now

For the case that a virus scanner triggers or you suspect an infection, the agencies set out a sequence. It is worth knowing before the moment arrives.

First, disconnect the affected device from the internet immediately so the outbound connection breaks. After that, an assumption applies that is uncomfortable but correct: even if the malware was detected and removed, you have to assume data including wallet information has already been exfiltrated. So you set up a new wallet on a separate device, move all assets across and keep the new seed phrase offline.

Because undetected malware can remain on the affected machine, the agencies then back up the important data and reinstall the operating system completely. A virus scanner run does not replace this step. For companies, the advisory additionally recommends endpoint detection and response tools that monitor suspicious behaviour on end devices.

The order matters: disconnect first, then rescue the assets, then clean up. Reinstall the system first and you may lose credentials you still needed for the rescue.

Stolen coins and the tax office: what you have to clarify

When coins leave a private wallet, a question arises in Germany that has no comfortable answer: can the loss be claimed for tax purposes? A theft is not a disposal within the meaning of Section 23 of the German Income Tax Act, so no private sale transaction takes place. Whether and under what circumstances a loss can nevertheless be taken into account is disputed and depends on the individual case. Settle it with a tax adviser before you put anything in your return.

Independently of that, one practical rule holds: you need complete documentation. That includes the time of the outflow, the transaction IDs, the acquisition data of the affected holdings and the criminal complaint. Anyone tracking their holdings through a portfolio and tax tool already has that history in one place. We have described how the tax office handles lost holdings in more detail using the example of a lost hardware wallet.

How to spot a fake job offer before the first click

The advisory contains a list of observations that comes from the opposite direction: a Japanese crypto exchange received an application for a developer role in May 2025, recognised the irregularities and did not hire the candidate. No damage occurred. The characteristics carry over.

The CV stood out first: an unusually broad palette of skills, with more than ten items each for programming languages, blockchain technologies and cloud services. Added to that, a degree from a European university followed by rapidly changing positions in various European and Asian cities. In the video call the language skills did not match the claimed career; simple questions were answered, but the candidate could say nothing about most of the skills listed. Access to the application form came through a VPN service.

From further interviews the agencies name additional patterns: excuses when an in-person meeting is proposed, a wish to be paid in cryptocurrency, frequent glances at a second monitor, occasional background voices and repeated freezing of picture or sound. It is also a red flag when remuneration is supposed to go to an account held in a different name.

Conversely, the simplest check applies to you as a candidate: a reputable company does not require you to execute unfamiliar files on your private machine at an early stage of hiring. Where that does happen, the assignment belongs in a virtual machine or nowhere near your device.

Checking for the WaterPlum scheme: your takeaways

1. Separate your devices, today. The machine on which you open third-party code, hiring assignments or unknown projects has no business holding keys. The clean solution is a dedicated device for custody where the private key never leaves the hardware; the differences are in our hardware wallet comparison.
2. Check your documentation before you need it. Acquisition data, transaction IDs and holding periods decide what you can actually prove to the tax office if the worst happens. A look at the crypto tax tools shows which one keeps that history for you.
3. Treat every unsolicited job offer as an attack surface. Verify the company and the contact independently, refuse to execute unfamiliar files, and open unknown projects in restricted mode. The case of the money mule scheme shows how quickly a supposed crypto job offer carries legal consequences.

The agencies close their advisory with a note that is honest about the shelf life of such lists: the techniques described are examples, and the actors keep developing their methods. Separating the work device from the key device survives that development, because it does not hang on any single piece of malware.

The full advisory of September 18, 2026 is available as a document from the FBI's Internet Crime Complaint Center. The Bundesamt für Verfassungsschutz has previously published its own security advisory on North Korean IT workers.

(As of September 19, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)