According to CoinMeta, North Korean hacker group WaterPlum disguised itself as recruitment teams for cryptocurrency companies AI and NFT, and distributed malware to software developers and professionals in the field of IT. The group infected at least 30,000 devices in over 100 countries, and between December 2025 and July 2026, it extracted funds or account credentials from more than 7,000 cryptocurrency wallets, stealing at least $10.7 million in total.