A message arrives on LinkedIn, Telegram, or a freelance job board. Someone claims to represent a crypto, AI, or NFT startup and offers paid work: a smart contract fix, a frontend bug, a short technical interview. The pay sounds reasonable, the company has a working website, and the person on the other end seems normal to talk to. Then comes the ask: download a project from GitHub and run it locally, or install a tool to join the video call. Hours later, the wallet on that same computer is empty.
This is not a rare, one off trick. It is a well documented pattern that security researchers and multiple government agencies have been tracking for years, and it keeps adapting.
What the scam actually looks like
The approach varies, but the shape repeats. A recruiter or hiring manager, often using a convincing fake profile or a cloned real one, reaches out with a legitimate sounding opportunity in web3, AI, or blockchain development. At some point the conversation moves toward a technical task: fix this repository, debug this script, complete this coding challenge. The victim is told to clone a project and run a setup command, or to install a specific version of video calling software to join the "interview," sometimes with a message claiming the normal app has a bug and a patched version is attached.
Whatever gets installed is the actual payload. It is designed to search the device for anything valuable: browser extension wallet data, saved credentials, SSH keys, and clipboard contents, then send what it finds back to the attacker. From there, any wallet whose keys or saved session lived on that machine is at risk.
Who is behind it, and the scale involved
In September 2026, agencies from the United States, Japan, Australia, and Germany, including the FBI, jointly attributed a large share of this activity to a North Korea linked group that researchers track under several names, most commonly Contagious Interview, with the Japanese National Police Agency calling it WaterPlum. According to that joint advisory, the group has compromised more than 30,000 devices across over 100 countries and taken funds or credentials from more than 7,000 cryptocurrency wallets, with losses estimated at over 10.7 million dollars. Separate security research firms, including Socket and multiple npm registry analyses, have independently tracked hundreds of malicious packages tied to the same campaign, published under innocent sounding names and sometimes downloaded tens of thousands of times before being removed.
The targets named in the advisory are mainly developers, designers, and other technical specialists working in or around crypto, blockchain, and AI projects, which is exactly the population likely to also hold a self custody wallet on a work laptop.
Why it keeps working
The scam does not rely on breaking any cryptography or finding a flaw in a wallet app. It relies on a familiar professional ritual, a coding test or a video interview, where running unfamiliar code or installing new software feels completely normal. That is the actual vulnerability: not the blockchain, not the wallet, but the habit of trusting a download because the surrounding conversation felt legitimate.
It also exploits the fact that a hiring process has a built in reason to move quickly and to follow instructions from someone presenting themselves as an authority, which is the same social engineering lever used in other scams covered in our guide on fake support and impersonation scams.
What actually protects you
No antivirus signature keeps up with a constant stream of freshly packaged malware, so the real defense is about where code runs relative to where your keys live.
Never run code from an unverified source on the same device, or the same browser profile, that holds a wallet with real funds. If you do any kind of freelance technical work in crypto, consider a dedicated machine, a separate user account, or at minimum a disposable virtual machine for cloning and running anything from an outside party, exactly the kind of separation described in our guide on securing the device your wallet runs on.
Treat a request to install custom video calling software as an immediate red flag. Legitimate interviews happen on mainstream platforms you already have installed. A "fix" that requires a separate download sent directly by the other party is the scam, not a technical accommodation.
Keep meaningful funds in a wallet whose keys never touch your everyday computer. A hardware wallet, discussed in our guide to choosing one, means that even a fully compromised laptop cannot sign a transaction without a physical confirmation on a separate device. For smaller, experimental amounts, a burner wallet limits what a single bad download can cost.
Verify the employer independently before doing any task. A real company's domain, LinkedIn page, and team should be checkable outside the conversation itself. If the only proof of legitimacy is what the recruiter tells you, that is not proof.
Act immediately if you already ran something suspicious. Disconnect the device from the internet, move any funds reachable from that device to a fresh wallet generated on a clean machine, and follow the steps in what to do if your wallet is compromised.
The takeaway
The mechanics of this scam are simple once you see the shape: a credible seeming job opportunity used as the delivery vehicle for malware aimed squarely at wallets. It has reportedly reached thousands of victims not because the technology is exotic, but because running a stranger's code during a hiring process still feels routine. Keeping the device that runs unfamiliar downloads separate from the device, or hardware wallet, that holds real funds removes the one step the entire scheme depends on.
This article is general educational information, not security advice for your specific situation.
Sources: joint multi agency advisory coverage via The Hacker News, North Korean fake job interview crypto theft coverage via Decrypt