According to CoinMeta, North Korean hacker group WaterPlum stole funds or credentials from over 7,000 cryptocurrency wallets through disguised recruitment and transferred approximately $10.71 million to North Korea. Between December 2025 and July 2026, the group infected at least 30,000 devices in more than 100 countries, impersonating companies such as AI, NFT, and others, to trick developers into downloading malware-infected files. Japanese law enforcement dismantled a laptop farm within their country and discovered that several hundred million yen in cryptocurrency assets had been transferred overseas. The investigation suggests that WaterPlum and some North Korean remote IT personnel are both affiliated with the 313rd General Bureau of North Korea's Military Logistics Industry Department.