North Korean Hackers Grab 7,000 Crypto Wallets in New Sweep
FxRoy
•
September 18, 2026
•
10 views
Japan’s National Police Agency dropped the details late yesterday. A North Korean-linked crew called WaterPlum has been busy. They hit more than 30,000 devices worldwide and walked away with records from over 7,000 crypto wallets.
Developers Were the Main Target
The hackers posed as recruiters on job sites. Fake offers for coding work led straight to malware. Once inside, they pulled private keys and seed phrases from developer machines. That’s a problem. One compromised laptop can hand over access to multiple company or personal wallets.
Why Target Developers Specifically?
Developers often hold elevated access during builds and testing. Stealing from them bypasses the usual exchange-level safeguards most retail traders rely on. The operation ran across more than 100 countries, showing the group’s reach is no longer limited to one region.
Numbers don’t lie. Seven thousand wallets represent a sizable haul even if not every record leads to an immediate drain. Past North Korean campaigns have shown the same pattern: gather first, liquidate later when heat dies down.
Market Reaction Stayed Muted
Bitcoin and ether barely flinched on the news. Broader sentiment already prices in state-level threats to the sector. Still, the timing matters. Several DeFi teams have faced similar recruitment lures in recent months. One more confirmed breach could shift that calm quickly.
Security firms tracking the group note the use of custom tools that blend with normal developer workflows. That makes early detection harder. Exchanges and wallet providers will likely face fresh questions about how they screen third-party access.
What Happens Next
Japan’s statement signals more coordination among law enforcement in Asia and Europe. Expect wallet providers to push multi-signature defaults and stricter key-handling rules for anyone touching code repositories. The bigger risk sits with smaller teams still running single-key setups.
Anyone holding meaningful size should treat this as another reminder that off-exchange keys need real isolation. Cold storage helps, yet it fails if the seed phrase lives on the same machine used for daily work. Watch for follow-up arrests or further wallet-draining reports in the coming weeks. This kind of exposure rarely stays quiet for long.