Seven agencies price North Korea's fake-recruiter funnel at $1,530 a wallet

Divide the traced money by the victims and the operation looks cheap. The $10.71 million moved to North Korea works out at roughly $1,530 for each of the more than 7,000 wallets the crew took funds or credentials from. Per machine it is about $357, across the at least 30,000 infected devices ^{[4] [3] [1] [2]}. Across the roughly eight months from December 2025 to July 2026, the run rate is about $1.34 million a month against some 3,750 new infections a month ^[4]. Under one machine in four produced a wallet worth draining ^[3].

Set that against the prior year. CertiK attributed 60% of all crypto theft losses in 2025, some $2.06 billion, to North Korea-linked groups ^[16]. The whole eight-month campaign the seven agencies documented comes to about half a percent of that ^[5]. April's $285 million Drift Protocol hack, which followed six months of attackers posing as a quantitative trading firm, was roughly 27 times the entire WaterPlum total ^{[17] [6]}.

So the wallets are the small half of the take. The advisory counts credentials alongside funds ^[4]. The approach that harvests them is a job application: actors impersonate AI, crypto or NFT companies and reach developers through social media, job boards and freelance marketplaces, then set a technical interview or coding task requiring downloads from developer platforms ^[6]. Of the five malware families named, StoatWaffle hides in blockchain-themed repositories ^[7].

Japan's National Police Agency and the FBI assess that both WaterPlum and some of North Korea's remote IT workers report to the 313 General Bureau of the Munitions Industry Department. That bureau sits under the Workers' Party central committee ^[8]. The two used the same IP addresses to reach laptop farms, use crowdsourcing services and apply for jobs, which the agencies treat as evidence they are one operation ^[9]. The Defense Department's Cyber Crime Center said in a post on September 18 that the group is "compromising job seekers' computer networks, harvesting sensitive data, and stealing cryptocurrency - targeting IT professionals in Japan, U.S., Europe, and beyond" ^[18].

Japanese authorities dismantled a laptop farm run by a domestic enabler, the first such case in the country, and found evidence that several hundred million yen in crypto had moved abroad ^[12]. A laptop farm is usually an enabler's home, where work computers are run remotely by IT workers in North Korea, China or Russia ^[13]. A Japanese crypto exchange turned away an applicant in May 2025 whose resume claimed implausibly broad skills and whose English did not match the record ^[14].

The crew's own costs are thin. Members used AI face-swapping in interviews before cutting video and asking the candidate to do the same, blaming the connection ^[10]. They practised Japanese pronunciation with text-to-speech tools and worked consistently on free machine-translation and AI tiers. On North Korean holidays they played games and watched soccer videos instead of running operations ^[11].

In my view the figure a crypto-exposed firm should price is the $285 million one, since the route in was the same months-long impersonation ^[17]. What would make that wrong: $10.71 million being close to the true total, with most of the 30,000 machines freelancers' personal laptops that had no path to corporate keys ^[3]. In that case the campaign is a tax on individual developers, and the money spent hardening hiring pipelines is misallocated.