North Korea Job Scam Drains $11M From Crypto Wallets

U.S. and allied agencies have tied a North Korea-linked cybercrime network to a campaign that used fake job interviews and remote IT worker schemes to drain about $11 million from roughly 7,000 cryptocurrency wallets.

The advisory, issued by seven agencies, links the WaterPlum hacking crew and Pyongyang's remote employment operation to the same bureaucratic apparatus. Investigators say the group used social engineering to gain access to targets, then moved funds out of compromised wallets.

The case adds another layer to North Korea's long-running effort to use cyber operations for revenue generation. It also highlights how employment scams, phishing and wallet compromise can converge into a single theft pipeline, especially when attackers exploit trust during hiring or contractor onboarding.

For crypto investors and firms, the incident is a reminder that operational security remains as important as market risk. Wallet hygiene, hardware-based key storage, strict verification of recruiters and contractors, and segmented access controls continue to be essential defenses.

The advisory arrives during a period of elevated risk appetite across digital assets, but the theft is unlikely to alter macro market direction on its own. Instead, it reinforces a familiar pattern: when liquidity is strong and prices are rising, attackers often intensify efforts to exploit user complacency.