Blockchain investigator ZachXBT published leaked data from a North Korean IT worker payment server, revealing over $3.5 million processed since November 2025, with default password '123456' and links to three sanctioned entities.
Blockchain investigator ZachXBT released an 11-part thread on April 8, 2026, exposing a leaked DPRK IT worker payment server that processed over $3.5 million since late November 2025. The server used default password '123456,' involved three OFAC-sanctioned entities, and went offline after publication.
Blockchain investigator ZachXBT published a leak from a North Korean IT worker payment server, revealing over $3.5 million processed since November 2025, with a monthly average of $1 million. Default password was '123456', and three OFAC-sanctioned entities were identified.
Blockchain investigator ZachXBT published leaked data revealing that North Korean IT workers processed approximately $1 million per month through the internal payment platform luckyguys.site, which used the default password '123456' and involved multiple OFAC-sanctioned entities.
Blockchain investigator ZachXBT published leaked data from a North Korean IT worker payment server, revealing over $3.5 million processed since late November 2025, with monthly flows of ~$1 million. Default password '123456' and OFAC-sanctioned entities were among the findings.
Ripple provides Crypto ISAC with high-confidence threat data on DPRK-linked fraudulent domains, wallets, and attack indicators, enabling member firms to vet candidates, contractors, and vendors via an integrated API.
On April 7, 2026, Stabble, a Solana-based DEX, told all liquidity providers to withdraw funds after onchain sleuth ZachXBT identified a former employee as a suspected DPRK IT operative. No exploit occurred; TVL stood at ~$1.75M. The new team paused operations for fresh audits.
Drift Protocol suffered a $286 million exploit after attackers allegedly used fake collateral, social engineering, and pre-signed governance transactions. Security firms linked the incident to DPRK-style tactics, raising fresh concerns over timelocks and Solana DeFi governance.
