LIVE MARKET INTELLIGENCE · Real-time dataCOINQUICKLY
Security2 min readSep 19, 2026

Japan, US, Australia and Germany Attribute Crypto Thefts to North Korea’s WaterPlum Group

Japan, the US, Australia, and Germany attributed crypto thefts to North Korea's WaterPlum group, citing infections across over 100 countries.

Key Takeaways

Japan, the US, Australia, and Germany attributed crypto thefts to North Korea's WaterPlum group, citing infections across over 100 countries.

Japan, US, Australia and Germany Attribute Crypto Thefts to North Korea’s WaterPlum Group
Photo: BlockchainReporter · Editorial analysis by CoinQuickly

According to BlockchainReporter, Japan’s National Police Agency joined the United States, Australia, and Germany on September 18 to publicly attribute a sweeping campaign of crypto thefts to WaterPlum, a North Korea-backed cyber group also known as Contagious Interview. The joint advisory indicates the group is under the command of the 313th General Bureau of the Korean Workers’ Party Central Committee’s Military Industry Department.

According to the official announcement, the group infected at least 30,000 machines across more than 100 countries, stole around 7,000 crypto wallet records, and moved at least about 1.7 billion yen in digital assets. WaterPlum targets IT engineers with fake job offers to deliver malware and drain crypto wallets. Additionally, Japanese police identified domestic laptop farms remotely operated by North Korean IT workers that sent funds overseas, and a Japanese crypto exchange detected North Korean IT worker job applications.

The four governments are warning IT engineers and companies worldwide to harden their defenses, treat unsolicited recruitment messages as security risks, and screen remote hires carefully.

Source & Fact-Check Note

This report is synthesized from coverage by BlockchainReporter. Information has been fact-checked and structured for market clarity by CoinQuickly’s research desk.

Read original article at BlockchainReporter