Autor Cointelegraph By Felix Ng

North Korean hacking group WaterPlum stole at least $10.7 million by posing as recruiters for legitimate crypto and AI companies, attacking unsuspecting job seekers with malware. The group, also known as Contagious Interview, targets software developers and IT professionals worldwide, according to a joint advisory from Japan, Germany, Australia and the US. Authorities said the fake recruiters impersonated legitimate AI, cryptocurrency or non-fungible token (NFT) companies and also used recruiting services.“The primary targets were individual web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies,” they added. The advisory also links WaterPlum to North Korea’s broader campaign of placing IT workers inside foreign companies, with Japanese and US authorities assessing that WaterPlum actors and some North Korean IT workers operate under North Korea’s Munitions Industry Department. According to the advisory, WaterPlum lured job seekers through social media platforms, online job platforms, gig work platforms or freelance marketplaces. During the recruitment process, victims were instructed to download and execute malicious files disguised as coding assignments or fixes for video-conferencing errors.Related: North Korea using foreign talent to help infiltrate US companies: ReportOnce the cyber actors obtained backdoor access to a victim’s computer, they used remote-access trojans and infostealing malware to exfiltrate sensitive data and cryptocurrency. Successful infections also create opportunities for WaterPlum actors to infiltrate organizations that employ the unsuspecting developers. WaterPlum infected at least 30,000 devices in more than 100 countries, with funds or account credentials extracted from over 7,000 cryptocurrency wallets between December 2025 and July 2026.However, the damage can extend beyond stolen cryptocurrency. Stolen identity documents allow North Korean IT workers to impersonate victims and earn income, and sensitive information could be used for extortion, it said. The advisory described a case in which a suspected North Korean IT worker applied for an engineering role at a Japanese crypto exchange using a forged resume. The exchange rejected the applicant after finding discrepancies during the interview, including an inability to explain the skills listed in his resume in detail. A more recent case occurred in July, when Cointelegraph reported that Consensys had unknowingly engaged a North Korea-linked developer as a consultant. The company told Cointelegraph it terminated their access after discovering the threat, and an investigation found no theft of assets or data, malicious code deployment or impact on user safety.The reported campaign is the latest example of North Korea’s persistent use of cryptocurrency theft to raise funds despite years of warnings and enforcement. The FBI blamed North Korea for the $1.5 billion Bybit theft in February 2025, while US authorities have warned about its undercover IT workers since at least 2018. Magazine: North Korea drives onchain malware surge, CoinEx shuts: Asia Express

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

World has launched World Money, a self-custody financial “super app” combining stablecoin payments, digital asset rewards and trading.The rollout began Thursday in more than 150 countries, World said, with features varying by location. Users can send supported digital assets, including stablecoins, to a recipient’s World username, deposit eligible assets to earn rewards, and buy and sell digital assets through exchanges.The app lets users access “Mini Apps” such as Kalshi, Credit and Morpho. A partnership with Stripe allows users to fund their accounts and buy stablecoins with Apple Pay, starting with users in the US. World has been expanding the financial capabilities of World App since its launch in May 2023, when it combined World ID with a crypto wallet, stablecoin transfers and token trading.In October 2024, World introduced World App 3.0 as a “super app for humans,” adding third-party Mini Apps and a Vault feature for earning on assets. In November 2025, it piloted virtual bank accounts in the US before rolling it out to more countries a month later, allowing paychecks and bank deposits that are converted into USDC. Related: Tools for Humanity expands World app toward super-app modelWith the launch of World Money, World said its identity and financial services are now split across two dedicated apps. World ID App handles identity verification and credentials, while World Money provides wallet, payment and other financial features. Existing World App and World ID App users can use their existing accounts for World Money, the company said. World Money is operated by Tools for Humanity, the company co-founded by Sam Altman and Alex Blania that develops technology for the World network.Magazine: Bitcoin treasury firms can outperform BTC… but is the risk worth taking?Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

US authorities on Thursday announced sanctions against Iranian crypto exchange BitBank, accusing it of processing Bitcoin paid by ships transiting the Strait of Hormuz.The US Department of the Treasury’s Office of Foreign Assets Control said that as of June, the Hormuz Safe Marine Services Authority used BitBank to transfer payments it received to the Islamic Revolutionary Guard Corps. The Treasury alleged it is part of the architecture used by Iranian financier Babak Zanjani to move hundreds of millions of dollars in Bitcoin to the IRGC.Treasury has previously alleged Hormuz Safe is part of an IRGC-backed scheme forcing vessels to buy maritime insurance for passage, including coverage against seizures by Iran itself.“Today’s designations of Iranian digital asset infrastructure make perfectly clear that efforts to finance the Iranian regime using cryptocurrencies are not beyond OFAC’s reach,” said US Treasury Secretary Scott Bessent. The designation is the latest Treasury action aimed at isolating Iran from the international financial system, including through sanctions on digital asset exchanges. The OFAC designations include BitBank, its developer Pishtaz Simorgh Electronic Trade Company and three associates of Zanjani, with the Treasury calling them “key components of the Iranian regime’s digital assets-based sanctions evasion infrastructure.”Cointelegraph reached out to BitBank for comment. Iran’s BitBank is a separate entity from bitbank, inc, a fully licensed crypto exchange founded in 2014 in Japan, which was acquired by SBI Holdings in June. Treasury’s designation lists BitBank as having been established in 2024. Related: Bitcoin tops $79K, oil falls as Trump says Iran war could end In August, the US sanctioned two digital asset exchanges, Shelbit and Aban Tether, accusing them of assisting the Iranian regime in sanctions evasion. Treasury also sanctioned four crypto exchanges, including the country’s largest, Nobitex, in June. In July, the US government ordered the freezing of more than $130 million in USDt held in wallets linked to Iran. Iran has reportedly sought to mitigate the impact of tightening financial restrictions. Earlier this month, the Financial Times reported that Iran’s central bank eased foreign currency controls to encourage businesses to bring overseas earnings home, including through cryptocurrency, amid tightening US sanctions. Magazine: North Korea drives onchain malware surge, CoinEx shuts: Asia Express