A recruiter offers you a Web3 job. The salary looks good. The coding test looks normal. Then your computer—and possibly your crypto wallet—belongs to someone else.

Imagine receiving this message:

“We saw your GitHub profile and think you'd be a great fit for our Web3 engineering team.”

The company looks real.

The recruiter has a convincing profile.

The salary is attractive.

The role involves crypto, AI or blockchain—exactly the kind of work already listed on your résumé.

You agree to an interview.

Everything feels normal.

Then comes the coding test.

You download the project.

Open it.

Run it.

And that may be the moment the interview ends and the attack begins.

This month, cybersecurity agencies from Japan, the United States, Australia and Germany jointly warned about a North Korea-linked campaign they call WaterPlum, also widely known as Contagious Interview.

The numbers are much bigger than I expected.

Authorities say the campaign has infected at least 30,000 devices across more than 100 countries.

More than 7,000 cryptocurrency wallets had funds or account credentials taken.

At least $10.71 million in cryptocurrency was transferred to North Korea, according to the advisory.

And the attack often begins with something completely ordinary:

looking for a job.

The Malware Is Hidden Inside the “Interview”

WaterPlum operators reportedly pose as employers or recruiters and contact software engineers, freelancers, Web3 developers and other IT professionals through social media, job platforms and freelance marketplaces.

They frequently impersonate companies working in:

AI,

cryptocurrency,

blockchain,

and NFTs.

During the recruitment process, applicants may be asked to complete an online technical interview or download a coding assignment.

That is where the trap appears.

Authorities say attackers have placed malicious code inside developer packages and projects, including NPM packages carrying malware families such as BeaverTail, InvisibleFerret, OtterCookie and related variants.

The victim thinks:

“I'm running a coding assessment.”

The attacker thinks:

“You just executed my loader.”

Why Crypto Developers Are Such Valuable Targets

A developer's computer can contain much more than source code.

It may have:

browser sessions,

API credentials,

SSH keys,

passwords,

GitHub access,

cloud credentials,

screenshots,

clipboard history,

wallet extensions,

and sometimes cryptocurrency recovery information.

The WaterPlum advisory specifically warns that attackers have targeted cryptocurrency wallet data including private keys and seed phrases, as well as browser authentication data, clipboard information, keystrokes and screenshots.

That makes one infected developer workstation potentially valuable in several different ways.

The attacker might steal crypto directly.

Or steal credentials.

Or access the developer's employer.

Or use the victim's identity in another operation.

One infection can become the beginning of several attacks.

The Scariest Part Is That Nothing Looks Like a Crypto Scam

There is no message saying:

“Send Bitcoin to this address.”

There may be no fake Ledger support account.

No fake MetaMask popup at the beginning.

No obvious seed phrase form.

You are simply interviewing for a job.

That is what makes this campaign interesting.

The attacker does not attack your crypto first.

They attack your trust first.

And only after they gain access to the machine do they start looking for everything else.

A Hardware Wallet Helps—but Don't Misunderstand What It Solves

This is where the security distinction becomes important.

If your long-term private keys remain inside a properly used hardware wallet, malware on a PC should have a much harder time simply extracting those keys compared with a browser wallet whose secrets live on the computer.

That is one reason hardware wallets exist.

But that does not mean:

“I own a Ledger, therefore an infected computer cannot hurt me.”

Malware can still potentially interfere with the environment around your wallet.

It can monitor the clipboard.

Steal browser sessions.

Replace information on screen.

Target software wallets.

Observe what you type.

Or wait for you to expose recovery information yourself.

A hardware wallet protects one important boundary.

It does not make the computer trustworthy.

The Official Recovery Advice Is Especially Important

The joint advisory contains one recommendation that every crypto user should notice.

If a computer has been compromised, authorities say users should assume wallet information may already have been exfiltrated.

Their recommendation is to create a new wallet on a separate device, move the assets, and store the new seed phrase offline. They also recommend resetting the affected operating system because undetected malware may remain.

That distinction matters.

If your seed phrase may have been exposed, installing antivirus software and continuing to use the same seed does not make that seed secret again.

A compromised recovery phrase remains compromised.

For anyone rebuilding a cold-storage setup after an incident, I keep a longer practical guide on how to store a seed phrase long-term at CryptoSafeKit. The important principle is simple: recovery information intended for cold storage should remain offline and physically protected.

That is the only CryptoSafeKit link I would put into this article.

The Coding Test Is Now Part of Your Threat Model

Developers are used to downloading code from strangers.

That is literally part of the job.

Interview:

“Clone this repository.”

Freelance project:

“Run this package.”

Bug report:

“Open this VS Code project.”

Open-source collaboration:

“Try this branch.”

The problem is that developer tools are designed to execute code.

WaterPlum is taking advantage of something completely normal in software development.

The official advisory therefore recommends treating unknown development projects carefully, including using VS Code's Restricted Mode and inspecting files such as .vscode/tasks.json before allowing a project to execute tasks automatically.

For crypto users, I would simplify that into one rule:

Do not run an interview project on the same machine that controls important crypto accounts.

That separation may feel inconvenient.

So does losing a wallet.

“But the Recruiter Looked Real”

That no longer proves very much.

Authorities say WaterPlum actors have used legitimate recruiting platforms and social networks.

The broader North Korean IT-worker operations documented in the same advisory also involve false identities, VPNs, remote systems and even AI-assisted tactics.

A polished LinkedIn profile is not authentication.

A professional Zoom call is not authentication.

A GitHub repository is not authentication.

A coding test is not automatically safe simply because coding tests are normal.

Modern attacks increasingly work by placing malicious actions inside normal workflows.

That is the larger lesson.

The Attack Doesn't Need Your Seed Phrase on Day One

This is another reason the campaign is worth paying attention to.

People imagine crypto theft like this:

attacker asks for seed → victim gives seed → crypto disappears.

WaterPlum demonstrates a longer path:

Recruiter → interview → coding project → malware → persistent access → wallet data → theft.

The crypto theft can happen much later.

And by the time the victim notices, the original “job interview” may be completely forgotten.

If Someone Sent Me a Coding Test Tomorrow

I would not run it on the computer where I manage long-term crypto.

I would verify the company independently.

I would inspect the repository before execution.

I would be suspicious of instructions asking me to disable security controls or troubleshoot unusual video-conferencing “errors.”

And if I discovered malware on a computer that had ever handled wallet secrets, I would not automatically assume that removing the malware restored those secrets to safety.

Once a secret may have escaped, the safest mental model is:

it is no longer a secret.

The $10.7 Million Is Not the Most Important Number

The headline number is large.

But the number that bothers me more is:

30,000 computers.

Because each one began with a human being doing something completely reasonable.

Trying to get a job.

That is what sophisticated social engineering looks like.

The victim does not have to be reckless.

They only have to perform one normal action at the wrong time.

One Question for the Comments

This is the part I'm genuinely curious about:

If a company offered you a well-paid Web3 job tomorrow and sent you a GitHub coding test, would you run it on your normal computer?

Would you use:

a VM?

a spare laptop?

an isolated machine?

or just inspect the code and run it?

And if that computer also had MetaMask, Ledger software or exchange accounts on it—would that change your answer?

I suspect a lot of experienced crypto users have never thought about a job interview as part of their wallet threat model.

Now they probably should.

Security note: Never post seed phrases, private keys, wallet balances or recovery locations in the comments. If a computer that handled crypto secrets is confirmed compromised, follow current guidance from the relevant wallet provider and security authorities rather than attempting recovery through unsolicited tools or support messages.