CoinMeta data: A North Korean gang impersonated recruiters and stole funds or credentials from over 7,000 cryptocurrency wallets, transferring approximately $10.71 million to Pyongyang. In a joint report released on September 18th, agencies from seven countries indicated that this gang, referred to as “Sui Mei” by the Japanese National Police Agency, infected more than 30,000 devices between December 2025 and July 2026. Their targets included web designers, engineers, and professionals in the fields of cryptography, blockchain, and Web3. The report also mentioned that the Sui Mei gang approached developers through social media, recruitment websites, and freelance markets, setting up technical interviews or coding tasks, and requiring candidates to download files from development platforms. The report listed five families of malware, including Beavertail, Invisibleferret, and Stoatwaffle.