Skip to main content

Ask RayNew Trends Ads Appearances Podcasts API

We value your privacy

We use cookies to understand how you use our platform and to improve your experience. Click “Accept All” to consent, or “Decline non-essential” to opt out of non-essential cookies. Read our Privacy Policy.

Fit Crypto Explorer

Fit Crypto Explorer

Case File #79: Trust Is the Attack Surface

Sep 22, 2026 · 18 min · 9 segments

This week on Crypto Weekly Recap, we’re looking at one of the biggest weaknesses in crypto security: trust. North Korea-linked hackers reportedly used fake job interviews to compromise thousands of…

This week on Crypto Weekly Recap, we’re looking at one of the biggest weaknesses in crypto security: trust. North Korea-linked hackers reportedly used fake job interviews to compromise thousands of devices and crypto wallets around the world. A compromised Cloudflare API key turned trusted Brevo website infrastructure into malware delivery. A custom Safe wallet module exposed millions in rsETH. And fraudulent government requests reportedly led to sensitive Revolut customer information being disclosed. Different attacks. Same lesson: Trust is not verification. We also break down this week’s market action, Federal Reserve policy, Bitcoin and Ethereum momentum, ETF flows, leverage, and a strong week for Avalanche. In Beginner’s Corner, we explain why you should never run unknown code on the same computer that holds your wallets, passwords, exchange sessions, or sensitive accounts. And in the HundredCoin Spotlight, we connect this week’s security lesson back to patience, discipline, and the value of slowing down before you act. I’ve personally been caught in a fake-job crypto scam before, so this week’s main story hits especially close to home. Security First. Hype Last. Stay patient. Stay disciplined. Stay dangerous to scammers. Keep it 💯.

This week on Crypto Weekly Recap, we’re looking at one of the biggest weaknesses in crypto security: trust. North Korea-linked hackers reportedly used fake job interviews to compromise thousands of…

Speakers: U.S.Host

Show signals: SuitabilityLimitedBiasNot politicalAudience≈1 followers

Spotify Apple Podcasts Amazon Music Website

Top entities: Attack surface Cloudflare×5 North Korea×4 Revolut×7 Brevo×6

Water Plum Fake Job Attacks1:31 – 4:24

U.S.Host

1:31

Security report.

U.S.Host

1:33

Water Plum, the job interview with the malware delivery system.

U.S.Host

1:39

This is the story of the week for me.

U.S.Host

1:41

And I'm going to tell you right now, this one hits close to home.

U.S.Host

1:45

Authorities in Japan, the United States, Australia, Germany issued a joint warning September 18th about a North Korea linked group they call Water Plum.

U.S.Host

1:58

also widely tracked as contagious, interviewed.

U.S.Host

2:03

The numbers are serious.

U.S.Host

2:05

Authorities say Waterplum compromised at least 30,000 devices across more than 100 countries between roughly December 2025 and July 2026.

U.S.Host

2:19

Information of funds connected to more than 7,000 cryptocurrency wallets were compromised and at least $10.71 million in cryptocurrency was transferred to North Korea-linked wallets.

U.S.Host

2:34

But listen to how they got in.

U.S.Host

2:35

Fake jobs, fake recruiters, fake coding interviews, attackers, impersonated companies in AI, cryptocurrency, NFT, and technology industries.

U.S.Host

2:50

You applied for their job.

U.S.Host

2:52

You get an interview.

U.S.Host

2:53

Everything feels normal.

U.S.Host

2:55

Then they send you a coding assignment, maybe a GitHub repository, maybe an NPM package.

U.S.Host

3:03

Maybe they tell you the video call isn't working and ask you to run something to fix it.

U.S.Host

3:10

You then execute the code and that's it.

U.S.Host

3:14

Malware lands on your machine.

U.S.Host

3:18

Water Plum has used malware families including Beaver Tail, Invisible Ferret, and Otter Cookie to steal information and maintain remote access.

U.S.Host

3:29

Now let me make this personal because I've also been scammed through a fake job set up before.

U.S.Host

3:35

So when I read stories like this, I'm not looking at it from a distance.

U.S.Host

3:39

I know how normal the beginning can feel.

U.S.Host

3:43

Nobody starts the conversation by saying, Hey, I'm about to steal your crypto.

U.S.Host

3:48

They give you a story that makes the next action feel reasonable.

U.S.Host

3:52

That's social engineering.

Attack surfaceEntity
98%1 mention
CloudflareCompanyCompany
94%5 mentions
North KoreaCountryCountry in East Asia
90%4 mentions
RevolutCompanyFinancial services company
86%7 mentions
BrevoCompanyCompany
82%6 mentions
CoinGeckoCompanyCompany
78%2 mentions
Federal Reserve SystemGovernment OrganizationCentral bank
74%1 mention
EthereumSoftware ApplicationSoftware
70%1 mention
CoinmarketcapWebsiteWebsite
66%2 mentions
BitcoinEntityCryptocurrency
62%2 mentions
Microsoft WindowsSoftware ApplicationOperating system
58%3 mentions
Artificial intelligenceEntityProfessional field
54%1 mention
Non-fungible tokenEntity
50%1 mention
GitHubCompanyCompany
44%1 mention
npmSoftware ApplicationSoftware
44%1 mention
JavaScriptEntityProgramming language
38%1 mention
AustraliaCountryCountry in Oceania
30%1 mention
GermanyCountryCountry in Europe
30%1 mention
JapanCountryCountry in East Asia
30%1 mention
UniswapCompanyChain
22%1 mention
Decentralized financeEntity
18%1 mention
PowerShellSoftware ApplicationComputer program
14%1 mention
MetaMaskSoftware ApplicationSoftware
10%1 mention
Secure ShellSoftware ApplicationComputer application
6%1 mention
TelegramSoftware ApplicationDownloadable software
2%1 mention

Malware AttacksCrime > Cybercrime
Threat IntelligenceGovernment > Cybersecurity Policy > International Cooperation
CryptocurrencyFinance
Society
PhishingCrime > Cybercrime > Malware Attacks > Identity Theft
Data BreachesFinance > Cryptocurrency > Wallet Security
Risk ManagementFinance > Cryptocurrency > Wallet Security > Data Breaches
Public SafetyGovernment > Cybersecurity Policy > International Cooperation > Threat Intelligence
Trust in TechnologySociety > Digital Privacy > Personal Security > Data Protection
CybersecurityTechnology
MalwareTechnology > Cybersecurity
International CooperationGovernment > Cybersecurity Policy
Personal SecuritySociety > Digital Privacy
Cybersecurity PolicyGovernment
Social EngineeringTechnology > Cybersecurity > Malware
CryptocurrencyTechnology > Cybersecurity > Malware > Social Engineering
CybercrimeCrime
Identity TheftCrime > Cybercrime > Malware Attacks
Wallet SecurityFinance > Cryptocurrency
Digital PrivacySociety
Data ProtectionSociety > Digital Privacy > Personal Security
Technology
Government
Crime
Finance

Water Plum Fake Job Attacks1:31 – 4:24

U.S.Host

1:31

Security report.

U.S.Host

1:33

Water Plum, the job interview with the malware delivery system.

U.S.Host

1:39

This is the story of the week for me.

U.S.Host

1:41

And I'm going to tell you right now, this one hits close to home.

U.S.Host

1:45

Authorities in Japan, the United States, Australia, Germany issued a joint warning September 18th about a North Korea linked group they call Water Plum.

U.S.Host

1:58

also widely tracked as contagious, interviewed.

U.S.Host

2:03

The numbers are serious.

U.S.Host

2:05

Authorities say Waterplum compromised at least 30,000 devices across more than 100 countries between roughly December 2025 and July 2026.

U.S.Host

2:19

Information of funds connected to more than 7,000 cryptocurrency wallets were compromised and at least $10.71 million in cryptocurrency was transferred to North Korea-linked wallets.

U.S.Host

2:34

But listen to how they got in.

U.S.Host

2:35

Fake jobs, fake recruiters, fake coding interviews, attackers, impersonated companies in AI, cryptocurrency, NFT, and technology industries.

U.S.Host

2:50

You applied for their job.

U.S.Host

2:52

You get an interview.

U.S.Host

2:53

Everything feels normal.

U.S.Host

2:55

Then they send you a coding assignment, maybe a GitHub repository, maybe an NPM package.

U.S.Host

3:03

Maybe they tell you the video call isn't working and ask you to run something to fix it.

U.S.Host

3:10

You then execute the code and that's it.

U.S.Host

3:14

Malware lands on your machine.

U.S.Host

3:18

Water Plum has used malware families including Beaver Tail, Invisible Ferret, and Otter Cookie to steal information and maintain remote access.

U.S.Host

3:29

Now let me make this personal because I've also been scammed through a fake job set up before.

U.S.Host

3:35

So when I read stories like this, I'm not looking at it from a distance.

U.S.Host

3:39

I know how normal the beginning can feel.

U.S.Host

3:43

Nobody starts the conversation by saying, Hey, I'm about to steal your crypto.

U.S.Host

3:48

They give you a story that makes the next action feel reasonable.

U.S.Host

3:52

That's social engineering.

Sign up to see more

The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode

Create an account Already have an account? Log in

No account is needed to search Radar.