North Korea-linked cyber group WaterPlum, also known as “Contagious Interview,” is accused of stealing at least $10.7 million by impersonating recruiters for legitimate cryptocurrency and AI companies. According to a joint advisory cited by authorities in Japan, Germany, Australia and the United States, the operation targets software and IT professionals worldwide, using malware delivered during fake hiring workflows.

The campaign blends social engineering with direct technical compromise: victims are lured through recruiting channels and then tricked into downloading and running malicious files disguised as coding tasks or “fixes” for video-conferencing problems. Once attackers gain access, they use remote access tools and infostealing malware to extract both data and cryptocurrency.

Key takeaways

• At least $10.7 million stolen, according to the joint advisory, via a fake recruitment scheme tied to WaterPlum.
• More than 30,000 device infections across over 100 countries were attributed to the group.
• 7,000+ cryptocurrency wallets affected between December 2025 and July 2026, with funds or credentials reportedly extracted.
• The lure is professional hiring: attackers impersonate AI, crypto and Web3 companies and sometimes leverage recruiting services.
• Secondary harm extends beyond theft, including identity document misuse and opportunities for impersonation, extortion, or further infiltration.

Recruitment scams as an entry point to crypto targets

In the advisory referenced by participating governments, WaterPlum is described as focusing on individuals such as web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies. The group reportedly uses social media, mainstream job platforms, gig work marketplaces, and freelance sites to reach candidates—then attempts to move victims into a “recruiting process” that culminates in malicious execution.

Authorities say the attackers impersonate legitimate companies, including those described as operating in the AI, cryptocurrency and NFT space. In some cases, the advisory also notes the use of recruiting services as part of the deception, potentially making the campaign look more credible to applicants who may be unfamiliar with threat patterns.

Malware delivery disguised as work tasks

The advisory describes a workflow designed to lower victims’ suspicion. During recruitment, job seekers are reportedly instructed to download and execute malicious files that are presented as coding assignments or as troubleshooting materials, including alleged fixes for video-conferencing errors.

This matters for organizations and candidates because it turns a common administrative step—reviewing a “take-home” task or installing something to support an interview or call—into a high-risk trigger. For employers in the crypto and AI sector, it also increases the chance that a compromised machine becomes the starting point for a deeper breach, not just an isolated incident.

Backdoor access, data theft, and wallet compromise

Once infections succeed, WaterPlum is said to establish backdoor access to a victim’s device. The advisory attributes subsequent activity to the use of remote-access trojans alongside infostealing malware to exfiltrate sensitive information and cryptocurrency-related assets.

In terms of scale, the advisory claims that WaterPlum infected at least 30,000 devices in more than 100 countries. It also alleges that between December 2025 and July 2026, the group extracted funds or account credentials from over 7,000 cryptocurrency wallets.

While these figures indicate substantial operational reach, the advisory also emphasizes that the campaign’s purpose is broader than direct theft. Stolen identity documents and other personal data can enable attackers to impersonate victims, pursue employment or access opportunities, and potentially support extortion efforts.

Linked to North Korea’s use of IT access inside foreign firms

The advisory links WaterPlum to North Korea’s wider pattern of placing IT workers into foreign organizations. Japanese and US authorities assess that WaterPlum actors—and at least some North Korean IT workers—operate under North Korea’s Munitions Industry Department.

The report also includes an example in which a suspected North Korean IT worker applied to a role at a Japanese crypto exchange using a forged resume. Authorities said the exchange rejected the applicant after inconsistencies surfaced during interviews, including an inability to discuss skills listed on the resume in detail.

More recently, Cointelegraph previously reported a case involving Consensys, which had unknowingly engaged a North Korea-linked developer as a consultant. Cointelegraph reported that the company terminated the individual’s access after identifying the threat. In that case, an investigation reportedly found no evidence of asset or data theft, malicious code deployment, or impact on user safety.

Taken together, these examples reinforce a recurring asymmetry: even when companies stop short of a full compromise, the recruitment stage itself can still create risk—through compromised endpoints, identity fraud, and attempts to gain legitimate access to organizations that handle crypto-adjacent workflows.

Why the story matters for crypto teams now

WaterPlum’s alleged tactics arrive amid continuing concern from US authorities about North Korea’s persistent efforts to use cyber operations and cryptocurrency theft to fund activity. The advisory references years of warnings and enforcement, and earlier coverage highlighted claims that the FBI blamed North Korea for the $1.5 billion Bybit theft in February 2025. It also points to US Treasury statements warning about undercover IT workers dating back to at least 2018.

For crypto employers and candidates, the practical takeaway is that security scrutiny needs to extend beyond “obvious” phishing. Recruitment processes—especially those involving coding tasks, file downloads, or remote collaboration—should be treated as an attack surface. Conducting verification steps, using safe sandboxing for any executables, and ensuring that sensitive systems are protected against endpoint compromise can reduce the chance that a job offer becomes a foothold.

Readers should watch next for whether regulators and major crypto organizations publish updated hiring security guidance in response to the advisory’s details, and whether more victims or additional campaigns linked to WaterPlum are identified—particularly around the reported wallet credential extractions and the use of stolen identities for follow-on access.

North Korean hacking group WaterPlum stole at least $10.7 million by posing as recruiters for legitimate crypto and AI companies, attacking unsuspecting job seekers with malware. 

The group, also known as Contagious Interview, targets software developers and IT professionals worldwide, according to a joint advisory from Japan, Germany, Australia and the US. Authorities said the fake recruiters impersonated legitimate AI, cryptocurrency or non-fungible token (NFT) companies and also used recruiting services.

“The primary targets were individual web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies,” they added. 

The advisory also links WaterPlum to North Korea’s broader campaign of placing IT workers inside foreign companies, with Japanese and US authorities assessing that WaterPlum actors and some North Korean IT workers operate under North Korea’s Munitions Industry Department. 

According to the advisory, WaterPlum lured job seekers through social media platforms, online job platforms, gig work platforms or freelance marketplaces. During the recruitment process, victims were instructed to download and execute malicious files disguised as coding assignments or fixes for video-conferencing errors.

Related: North Korea using foreign talent to help infiltrate US companies: Report

Once the cyber actors obtained backdoor access to a victim’s computer, they used remote-access trojans and infostealing malware to exfiltrate sensitive data and cryptocurrency. 

Successful infections also create opportunities for WaterPlum actors to infiltrate organizations that employ the unsuspecting developers. 

WaterPlum infected at least 30,000 devices in more than 100 countries, with funds or account credentials extracted from over 7,000 cryptocurrency wallets between December 2025 and July 2026.

However, the damage can extend beyond stolen cryptocurrency. Stolen identity documents allow North Korean IT workers to impersonate victims and earn income, and sensitive information could be used for extortion, it said.

The advisory described a case in which a suspected North Korean IT worker applied for an engineering role at a Japanese crypto exchange using a forged resume. The exchange rejected the applicant after finding discrepancies during the interview, including an inability to explain the skills listed in his resume in detail.

A more recent case occurred in July, when Cointelegraph reported that Consensys had unknowingly engaged a North Korea-linked developer as a consultant. The company told Cointelegraph it terminated their access after discovering the threat, and an investigation found no theft of assets or data, malicious code deployment or impact on user safety.

The reported campaign is the latest example of North Korea’s persistent use of cryptocurrency theft to raise funds despite years of warnings and enforcement. The FBI blamed North Korea for the $1.5 billion Bybit theft in February 2025, while US authorities have warned about its undercover IT workers since at least 2018. 

Magazine: North Korea drives onchain malware surge, CoinEx shuts: Asia Express

Goldman Sachs and Citizens analysts say Coinbase is the company closest to compliance under the Securities and Exchange Commission’s new five-year tokenized-stock exemption, with Robinhood and Circle also positioned to benefit, in assessments laid out in a September 20 report.

The SEC’s innovation exemption creates a path for qualifying tokenized U.S. stocks to trade through automated market makers on public blockchains. To qualify, tokens must preserve shareholder rights such as dividends and voting, and venues face limits on trading volume and the number of stocks they can offer. Issuers also get the right to object before third-party tokenized versions of their shares can begin trading.

Goldman Sachs analysts said Coinbase could benefit across several parts of its business. Its existing tokenized-equity offering already carries many of the characteristics the SEC requires, including shareholder rights and dividends comparable with the underlying stock. The company also runs an institutional custody business and Coinbase Tokenize, an infrastructure service for other firms putting assets onchain. Analysts at Citizens highlighted the same reach, adding Coinbase’s stablecoins and its Ethereum-based blockchain Base.

One gap remains. Coinbase’s exchanges use central limit order books to match trades, while the SEC framework is built around automated market makers, which price assets through onchain liquidity pools. Goldman Sachs analysts said that is a hurdle if Coinbase wants to operate a trading venue directly under the exemption.

Coinbase CEO Brian Armstrong addressed part of the gap in a post on X, writing that Coinbase Tokenized Stocks are “real fully-backed securities, redeemable for the underlying shares, with dividends integrated, and voting rights coming soon.” Voting rights are not live yet, and no venue decision has been stated.

The exemption frames what Robinhood must do. Its offshore stock tokens give price exposure to U.S. shares through a derivative without conveying the ownership rights the exemption requires, so they do not fit the framework as they stand. Robinhood CEO Vlad Tenev has said share redemptions and voting rights will be added, and analysts at Citizens expect the company to move quickly given its offshore tokenized-equity business and its Arbitrum-based Robinhood Chain. Those changes have not shipped.

Both banks also flagged Circle as an indirect winner, with its USDC stablecoin potentially used for settlement and collateral around onchain markets. Goldman Sachs analysts added that new venues are unlikely to take meaningful volume from incumbent exchanges such as Nasdaq and NYSE owner Intercontinental Exchange, given the trading caps, issuer opt-outs and the limits of automated market makers in deeper markets.

After a year of legislative momentum, the US Senate failed to advance the Digital Asset Market Clarity (CLARITY) Act when a cloture motion fell short. The proposal—intended to clarify parts of US crypto market structure—needed 60 votes to proceed and instead received 49 in favor and 50 against, effectively stalling the bill for the current Congress.

Republican Senator Thom Tillis signaled that his “no” vote may have been tactical rather than final, indicating he switched positions late to preserve the ability to call a new vote later. Still, multiple lawmakers and industry figures point to an increasingly narrow window for compromise before the legislative calendar tightens further.

Key takeaways

• The Senate cloture vote on the CLARITY Act failed 49–50, preventing immediate progress toward passage.
• Tillis suggested he changed his vote at the last minute to enable another attempt later, but timing constraints remain severe.
• Regulators moved quickly in the legislative vacuum: the SEC announced a five-year exemption for limited tokenized US stock trading, and the CFTC provided additional regulatory relief for “passive software” providers.
• The House advanced separate crypto policy measures, including a committee approval for a “Strategic Bitcoin Reserve” framework and progress on crypto tax legislation.

Why CLARITY’s cloture failure matters for crypto market structure

The Senate’s decision is significant less for what it signals about individual lawmakers and more for what it delays for the broader market. CLARITY has been positioned as a legislative solution to long-running questions about how certain crypto activities should be regulated in the US. With cloture failing, lawmakers cannot simply move forward through the usual legislative pipeline during this session.

Although Tillis’s comments introduce uncertainty—because a similar dynamic has played out with other bills—lawmakers close to the process emphasized that time is now a binding constraint. Congressman Shri Thanedar, a Democrat who backed CLARITY in the House, described the remaining timeline as a major barrier.

“There are only 20 legislative days left in this Congress, all of them after the midterms, making odds of a 2026 compromise, unfortunately, very low.”

In addition to the vote math, congressional scheduling has created a practical problem. NEAR’s chief legal officer, Abhishek Vaidyanathan, pointed out that the House had already canceled two “sitting weeks,” and noted that the Senate’s state work period began on October 5. With that backdrop, the likely opportunity for a revised approach may shift to the next Congress rather than being settled before the current session ends.

Senator Angela Alsobrooks also argued that negotiations were close right up to the moment of voting, but said Republican leadership shut down the effort at the last minute. Meanwhile, seven Democratic senators who had opposed the bill claimed they remain committed to passing it at some point—suggesting the political disagreements that surfaced during the cloture process have not been resolved, only postponed.

SEC and CFTC steps fill part of the regulatory gap

CLARITY’s collapse did not leave the industry waiting. In the days following the Senate vote, the SEC announced a five-year “Innovation Exemption” designed to allow limited trading of tokenized US stocks on decentralized public blockchains. The exemption aims to enable trading mechanisms that use automated market makers while avoiding registration as securities exchanges.

However, the exemption is not blanket coverage. The SEC’s framework does not extend to “synthetic” stock tokens that do not offer holders the same rights as traditional stock. The limitation matters because some tokenized stock products have structured exposure differently—meaning existing issuance and future product design could be directly affected by whether token holders receive full stock-like rights.

Separately, the CFTC also outlined a path for incremental compliance and expansion. It issued a no-action position for qualifying “passive software” providers—entities that connect users to regulated derivatives firms and exchanges—stating it would not recommend enforcement against qualifying providers or certain personnel for failing to register as introducing brokers or associated persons.

For application developers and wallet ecosystems, that relief could reduce friction for product features that route users into regulated derivatives trading venues. The policy still leaves room for interpretation on what qualifies as “passive” facilitation, which means operators will likely continue to scrutinize their product workflows and disclosures.

The CFTC has also submitted draft crypto market rules to the White House: “Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets.” At the time of reporting, the action was listed as being in a pre-rule stage, meaning it had not yet reached formal proposal.

Regulatory movement is also visible in the private sector’s filings with the CFTC. Coinbase applied to offer 24/5 perpetual futures trading tied to individual US stocks, and Kalshi filed a similar proposal on the same day—both efforts aimed at expanding regulated futures access within the US framework.

House committee advances Bitcoin reserve and tax certainty

While the Senate stalled CLARITY, other parts of Congress advanced crypto-adjacent legislation. The House Committee on Financial Services passed the American Reserve Modernization Act of 2026. The bill would codify an existing executive order establishing a “Strategic Bitcoin Reserve,” and also contemplate a broader “Digital Asset Stockpile” containing other forfeited cryptocurrencies held within the US Department of the Treasury.

Beyond formalizing the reserve concept, the legislation would require federal agencies to provide a full audit of digital assets they hold and to submit quarterly “proof of reserve” reports. It also directs a study of budget-neutral acquisition strategies for increasing Bitcoin holdings.

On the tax side, the House Ways and Means Committee advanced the Digital Asset Tax Certainty Act with bipartisan support. The reporting describes it as legislation aimed at reshaping how the federal government taxes digital assets—an area that has remained a practical concern for both investors and businesses due to uncertainty about classification and reporting.

Beyond policy: security and research signals for the wider ecosystem

The week’s policy developments were paired with security and research items that underline ongoing risks in the crypto economy.

One high-profile case involved a Revolut data breach that escalated into extortion. After sensitive customer data—including passports and KYC selfies—was stolen, a second hacker reportedly demanded a $3 million payout in Monero within 24 hours, threatening to sell customer records. Earlier reports had referenced a separate demand by another group for Bitcoin. The coverage also highlighted how KYC document storage across many companies can create “honeypot” targets for attackers.

From a research standpoint, a Chainalysis report found a sharp rise in onchain malware storage tied to state-linked actors. According to the report, new activity involving attackers storing malware instructions or infrastructure information on public blockchains increased by 420% over the past 12 months, with state-related actors accounting for roughly two-thirds of new activity each quarter.

Researchers at the Bank for International Settlements additionally warned about measurement problems in Bitcoin analytics. They found that estimates of onchain transfer values can vary dramatically—up to sixfold—depending on how transactions are measured, including treatment of change outputs and transfers back to the sender. The same methodological issue can also distort comparisons with Bitcoin market capitalization measures.

What to watch next as CLARITY’s window shrinks

With Senate cloture on CLARITY failing and lawmakers citing limited legislative days remaining, the near-term focus for many market participants is likely to shift from a single comprehensive bill to a patchwork of regulatory guidance and exemptions. The key question now is whether political leadership can find a viable pathway for CLARITY later—or whether the next Congress will be where the most consequential crypto market-structure changes finally take shape.

Story Continues

CLARITY vote fails, long live CLARITY

After a year’s buildup, the US Senate failed to pass a cloture motion on the Digital Asset Market Clarity (CLARITY) Act.

The motion received just 49 votes in favor and 50 against, well short of the 60 votes required.

However, Republican Senator Thom Tillis’s “no” vote was not all it seemed, and he confirmed he’d only switched sides at the last minute to enable him to call a new vote in future.

So does that mean the CLARITY Act could be resurrected? The GENIUS bill suffered a similar failed vote on cloture and then went on to pass just 11 days later.

While there is a small chance that CLARITY could still pass,the politics and the number of legislative days available suggests it’s unlikely.

Congressman Shri Thanedar, a Democrat who supported CLARITY in the House, told Magazine the timeline was a “major barrier.”

“There are only 20 legislative days left in this Congress, all of them after the midterms, making odds of a 2026 compromise, unfortunately, very low.”

Seven Democratic senators who had voted against the bill — claimed they “remain committed” to passing it. At some point. “We were ready to strike a deal today and in discussions right up until the vote. Republican leadership shut it down at the very last minute,” said Sen. Angela Alsobrooks.

NEAR chief legal officer Abhishek Vaidyanathan noted the House had already cancelled two sitting weeks and that the Senate’s state work period began October 5.

“Now that cloture failed, the next Congress is the likely next opportunity to address crypto market structure,” he said.

SEC Chair proposes new rules in absence of CLARITY

After the failed vote, Ripple CEO Brad Garlinghouse predicted that US regulators will “continue to work hard to issue rules to fill the legislative gap.”

The industry didn’t have long to wait with the US Securities and Exchange Commission announcing just two days later a five year long exemption allowing limited trading of tokenized US stocks on decentralized public blockchains.

The Innovation Exemption allows tokenized stock trading using automated market makers and exempts them from having to register as securities exchanges.

However the new rules do not exempt “synthetic” stock tokens that do not provide holders with all the same rights as traditional stocks. This is bad news for pretty much all of the stock tokens issued by xStocks and Robinhood to date.

CFTC swoops in to propose new crypto rules

The Commodity Futures Trading Commission also announced regulatory relief for “passive software” providers that connect users to regulated derivatives firms and exchanges.

It issued a no-action position stating it would not recommend enforcement against qualifying providers or their personnel for failing to register as introducing brokers or associated persons when facilitating trading with CFTC-registered firms and exchanges.

The position could make it easier for crypto wallets and other apps to offer access to regulated derivatives, including perpetual contracts and prediction markets.

The CFTC has also submitted draft crypto rules to the White House called the “Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets.” The action is listed at the “prerule” stage meaning it has not yet been formally proposed.

Coinbase this week filed an application with the CFTC to offer 24/5 perpetual futures trading to individual US stocks. Kalshi filed a very similar proposal on the same day.

House committee votes yes to Bitcoin Reserve

The American Reserve Modernization Act of 2026 passed the US House Committee on Financial Services this week. It would formalize the current executive order establishing a Strategic Bitcoin Reserve in law. A Digital Asset Stockpile containing other forfeited cryptocurrencies would also be held within the Department of the Treasury.

The legislation requires all federal agencies to provide a full audit of digital assets they hold and orders them to provide quarterly “proof of reserve” reports.. 

It would also direct a study of budget-neutral acquisition strategies for buying additional Bitcoin for the reserve. Bitcoin Policy Institute executive director Connor Brown on Wednesday called it a “genuinely historic step for Bitcoin policy.”

The US House Ways and Means Committee also passed the Digital Asset Tax Certainty Act with bipartisan support, advancing legislation aimed at reshaping the federal tax treatment of digital assets.

Revolut’s $3 million ransom demand highlights dangers of ID storage

The theft of sensitive customer data including passports and KYC selfies from Revolut took a turn for the bizarre when a second hacker demanded a $3 million ransom.

Calling themselves “IAmNotAVillain” the actor publicly demanded 6,000 Monero from Revolut within 24 hours or it would sell the customer records to criminal groups. 

Earlier a group calling itself “Revolut Smilik” had demanded 10,000 Bitcoin, worth about $780 million, for the data. IAmNotAVillain suggested the demand came from a former associate who only had a small sample of the data.

The theft highlighted the dangers of mandating KYC checks that result in thousands of companies storing ID documents all over the web, which act as honeypots for hackers.

Frustratingly, it’s now possible to verify identity using zero knowledge proofs without sending any identity documents to third parties at all, but the technology is not yet in wide use.

Winners and Losers

At the end of the week, Bitcoin (BTC) is up 5.9% to trade at $81,185, Ethereum (ETH) is up 6.6% to trade at $2,639 and XRP (XRP) is up 5.4% to $1.40. The total market cap is at $2.78 trillion according to CoinMarketCap.

Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are NEAR Protocol (NEAR) with a 76.4% gain, Arbitrum (ARB) on 64.3%, and Ethena (ENA) on 61.6%.

The top three altcoin losers of the week are Stable (STABLE) which was down 11.6%, Pi (PI) down 11.3% and SPX6900 (SPX) down 1.8%.

Prediction of the Week

Standard Chartered says Arbitrum could increase 70X by 2030

Standard Chartered says layer-2 network Arbitrum’s price could reach as high as $10 by 2030. From current levels, that would represent a roughly 70-fold increase, far exceeding Standard Chartered’s projected returns for Bitcoin (BTC) and Ether (ETH) over the same period.

Geoff Kendrick, Standard Chartered’s global head of digital assets research, said Arbitrum’s economics offer considerable upside because the network receives 10% of the net protocol revenue generated by companies building on it with Robinhood Chain being the first major example. Robinhood fees will push Arbitrum’s September revenue to $5 million, which is a five fold increase from before Robinhood Chain launched in July.

Kendrick said the biggest risks to his ARB price projection include “a slower-than-expected pace of asset tokenization and more competition from alternate blockchains.”

Top FUD Of The Week

State hackers drive 420% surge in onchain malware, Chainalysis finds

State-linked hackers accounted for roughly two-thirds of new activity each quarter as the number of times attackers stored malware instructions or infrastructure information on public blockchains rose 420% over the past 12 months, according to a Chainalysis report. 

Chainalysis identified North Korea and Iran-linked operators among the state actors adopting the technique. The analytics firm also connected previously unattributed activity spanning Tron, Aptos and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence. 

Chainalysis said using public blockchains increases the durability of malware campaigns because the stored information remains accessible after domains, servers or code repositories are taken down. 

BIS paper finds major gap in Bitcoin onchain transfer estimates

Researchers at the Bank for International Settlements found that estimates of Bitcoin onchain transfer values can vary by as much as sixfold depending on how transactions are measured.

The sixfold gap reflects differences between measurement methods, including how change outputs and other transfers back to the sender are treated.

The measurement problem also extends to Bitcoin’s market capitalization. The researchers found that the conventional measure has at times been as much as four times higher than realized capitalization, which values each coin at the price when it last moved.

Hong Kong jails ex-banker over $1.6B false credit, cryptocurrency bribes

A former bank official in Hong Kong who falsely authenticated letters of credit for more than $1.6 billion was sentenced to four years in prison and ordered to make restitution of more than $470,000 he received in cryptocurrency bribes.

Lam Chun-yin, 32, who was a customer relationship manager at China Construction Bank (Asia), had previously pleaded guilty in District Court, The Standard reported on Saturday.

Top Magazine Features of the Week

Is there any chance left to save the CLARITY Act?

CLARITY isn’t dead after failing a key Senate vote, but with time running short and Democrats still demanding changes, its path forward is narrowing.

Bitcoin treasury firms can outperform BTC… but is the risk worth taking?

Bitcoin treasury companies promise to amplify returns over investing in Bitcoin alone, but does the potential upside outweigh the risks to the downside?

Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

Zero-knowledge technology could let companies verify who you are without storing your identity documents. So why isn’t it already standard practice?

Story Continues

Can Trump’s triumphal arch also function as a military site?

Story Continues