# North Korean cryptocurrency cyberattacks > Live situation record from CLSTR: https://clstr.news/situations/north-korean-cryptocurrency-cyberattacks > Updated: 2026-09-18T11:50:25.000Z. Sources: 11. Developments: 2. North Korean-linked cyber activity has targeted various cryptocurrency ecosystems through both financial laundering and large-scale malware distribution. In late August 2026, blockchain analytics firm Arkham identified that North Korean hackers moved more than $30 million in bitcoin through the decentralized derivatives platform Hyperliquid. This activity highlighted the use of decentralized finance (DeFi) protocols to move funds through pseudonymous channels, prompting increased pressure from the Trump administration to bring such platforms under United States jurisdiction to ensure compliance with anti-money laundering regulations. By mid-September 2026, reports indicated broader vulnerabilities in digital asset security. A group known as WaterPlum, linked to North Korea, was reported by Japanese and FBI authorities to have infected over 30,000 devices across 100 countries between December 2025 and July 2026. The group utilized fake job offers from impersonated AI and crypto companies to distribute malware, successfully stealing data from approximately 7,000 crypto wallets. Concurrently, South Korean firm D’CENT began investigating unauthorized transfers involving its software-based App Wallet, suggesting that users who manually imported recovery phrases may have exposed assets such as Bitcoin, Ethereum, and XRP. ## Timeline ### 2026-09-18: Cryptocurrency security threatened by North Korean hackers and wallet software vulnerabilities Cybersecurity threats targeting cryptocurrency users have escalated, involving North Korean hackers infecting 30,000 devices and vulnerabilities found in D’CENT’s software-based wallet applications. 4 sources. https://clstr.news/cluster/cryptocurrency-security-threatened-by-north-korean-hackers-and-wallet-software-vulnerabilities ### 2026-08-31: North Korean hackers move $30 million via Hyperliquid North Korean hackers have moved over $30 million in bitcoin via the Hyperliquid platform, amid increasing U.S. regulatory pressure to bring the decentralized exchange under American jurisdiction. 7 sources. https://clstr.news/cluster/north-korean-hackers-move-30-million-via-hyperliquid --- Cite as: North Korean cryptocurrency cyberattacks. CLSTR, https://clstr.news/situations/north-korean-cryptocurrency-cyberattacks