Home
LeaderboardGlossaryContributeNewsletterStore

Archived tweet

Tweet thread by zachxbt:

1/ Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed. Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities. I then uncovered 25+ crypto projects with related devs that have been active since June 2024. Tweeted at 7:36 AM · Aug 15, 2024 2/ The laundering path for the incident can be described as: 1) Transfer $1.3M to theft address 2) Bridge $1.3M from Solana to Etheruem via deBridge 3) Deposit 50.2 ETH to Tornado 4) Transfer 16.5 ETH to two exchanges Theft address 6USfQ9BX33LNvuR44TXr8XKzyEgervPcF4QtZZfWMnet Tweeted at Aug 15 3/ Using multiple payment addresses for 21 devs I was able to map out a cluster with the most recent batch of payments for ~$375K over the last month. 0xb721adfc3d9fe01e9b3332183665a503447b1d35 In the past week you may have seen me tagging projects telling them to DM me. Tweeted at Aug 15 4/ Prior to this $5.5M flowed into an exchange deposit address with payments DPRK IT workers were receiving from July 2023 - 2024 and connections to Sim Hyon Sop who is OFAC sanctioned. 0x8f0212b1a77af1573c6ccdd8775ac3fd09acf014 Tweeted at Aug 15 5/ Some funny moments from the investigation include: - Russia Telecom IP overlap between devs supposedly in US and Malaysia. -Recorded dev and they accidentally leaked their other identities on a notepad -Dev payment addresses a few hops from Sang Man Kim and Sim Hyon Sop Tweeted at Aug 15 6/ A number of experienced teams have hired these devs so it’s not fair to them single as the ones to blame. Some indicators teams can look out for in the future includes: 1) They refer each other for roles 2) Good looking resumes / GitHub activity although sometimes lie Tweeted at Aug 15 Update: Shortly after posting another project found out they had hired one of the DPRK IT worker (Naoki Murano) listed in my table and shared my post in their chat. Immediately within two minutes Naoki left the chat and wiped his Github. Tweeted at Aug 15

Tweet #1

Image #1:

Image

Image #2:

Image

Tweet #2

Image #1:

Image

Tweet #3

Image #1:

Image

Tweet #4

Image #1:

Image

Image #2:

Image

Image #3:

Image

Tweet #5

Image #1:

Image

Image #2:

Image

Tweet #7

Image #1:

Image

Image #2:

Image