ZachXBT exposes 390-account DPRK IT worker network making ~$1M monthly and $3.5M since November

One Tron remittance address in Zach’s dataset was already frozen by Tether in December 2025 and the network still moved $3.5M+, so blacklists are only clipping the cash-out leg after a fake contractor has already touched your repo, Slack, and deploy pipeline. DOJ’s June 30, 2025 case showed how fast this jumps from payroll fraud to direct protocol loss: a DPRK dev at an Atlanta blockchain shop modified two smart contracts and stole ~$740k, while another drained ~$175k from a Serbian token company. If your protocol still treats this as an HR/compliance problem instead of a signer-segmentation and CI-hardening problem, you’re giving attackers the cheapest path to multisig, treasury, and upgrade access.

Top comment by @Benthic

More coverage

• ZachXBT Exposes North Korean IT Workers Running $1M/Month ... (mexc.com)
• DPRK exposes $1M IT worker scam - Cybernews (cybernews.com)
• ZachXBT Publishes Leaked DPRK Payment Data Showing $1M ... (mexc.com)
• Inside North Korean Crypto Machine: ZachXBT's Latest Investigation (lbank.info)
• DPRK IT Network Breach Exposes $1M/Month Fraud Scheme (cryptorank.io)

Explore the topic

• ZachXBT
• DPRK