GoKawiil
Tech News
Bitget said suspected North Korean hackers stole roughly $351.6 million from its hot and warm wallets after unauthorized transfers were flagged Thursday evening. The exchange has paused withdrawals and enlisted Mandiant and SlowMist to investigate, while saying its cold wallets, self-custodial wallet product, and customer balances remain unaffected.
Authorities in Australia, Germany, Japan and the US say a North Korean hacking group known as WaterPlum has compromised over 30,000 devices and 7,000 crypto wallets by posing as recruiters and sending malware-laced coding tests to tech workers. The scheme has netted at least $10.71 million in cryptocurrency, funneled back to North Korea.
Security researchers uncovered a North Korean state-linked hacking operation that impersonated job recruiters to trick victims into installing malware, ultimately compromising roughly 30,000 devices across multiple countries. The campaign used fake hiring processes and interview-related documents as delivery mechanisms for malicious software.
Cybersecurity agencies from Japan, the US, Australia and Germany issued a joint advisory identifying North Korea's WaterPlum group as the actor behind malware hidden in fake job application coding tests. The scheme has infected over 30,000 devices across 100 countries and compromised more than 7,000 crypto wallets, netting $10.71 million believed to fund the North Korean government.
A joint advisory from law enforcement in Japan, the US, Australia and Germany says the North Korean-linked group WaterPlum infected over 30,000 devices across more than 100 countries between December 2025 and July 2026. The hackers drained more than 7,000 cryptocurrency wallets and moved over $10.7 million worth of crypto assets to North Korea, using fake job interviews and malicious code disguised as coding tests or software projects to infect victims.
Researchers monitoring the area around North Korea's underground nuclear testing site have logged 1,399 local earthquakes since the country began detonating nuclear devices there. Scientists say this rate of seismic activity is unprecedented for the region compared to historical records.
Rapid7 reports that a stealthy espionage campaign has compromised South Korean automotive and media companies since early 2025, with medium-confidence attribution to North Korean APT37 based on overlapping command-and-control infrastructure. The attackers exploited the open-source HAProxy load balancer to install a custom Linux toolkit called TED, granting them visibility into and control over victims' network traffic.
Companies are introducing extra verification steps during job interviews to confirm candidates are genuine humans, not AI-assisted impersonators or fraudulent remote workers. The shift follows a rise in AI-generated deepfakes and schemes involving North Korean operatives posing as legitimate remote employees to infiltrate companies.
Security firm Huntress published findings from investigations conducted throughout 2026 in which it helped organizations confirm they had unknowingly hired North Korean operatives posing as IT staff. Cases included an Australian healthcare firm that flagged three employees suspected of impersonating Chinese nationals, plus two separate incidents in the financial services sector uncovered in August. Huntress noted these DPRK-linked workers have grown more skilled and active, blending into IT teams while funneling wages back to the regime and potentially planting malware or stealing data.
A joint alert from the US State Department, Japan, Canada and the UK warns that North Korean operatives are using falsified identity documents to get hired as remote IT workers at foreign companies, letting them enter corporate networks with legitimate-looking access. Separately, groups like Scattered Spider have used social engineering against help desks to trick staff into resetting passwords or MFA for accounts they don't own, bypassing strong authentication entirely.