9 Ethereum addresses a DOJ forfeiture complaint ties to a North Korean IT-worker theft (August 2024)
- Scam type: State-sponsored hacking
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: North Korean IT workers: August 2024 theft from Company 1
- Incident date: 2025-08-05
- Reported: 2026-10-28
- Last updated: 2026-10-28
A Justice Department civil forfeiture complaint filed August 5, 2025 says North Korean IT workers pose as non-North Korean nationals to get remote jobs, including at virtual currency platforms, and sometimes use that access to steal virtual currency. The complaint says the FBI attributed a theft from a company it calls Company 1, in or around August 2024, to North Korean IT workers. It names these Ethereum addresses. Addresses: 0xb713a396ce6a62df4c7c857d974f4a331bde1e03 0x27553f77d9d3ddf8e936c9cc00c2db6018edade4 0x9e4b887772060e35254fd53363d89effd4715ec5…
Other addresses in this report: 0xb713a396ce6a62df4c7c857d974f4a331bde1e03, 0x27553f77d9d3ddf8e936c9cc00c2db6018edade4, 0xe47eeb1d64f0a9eb9a670946723d538c5515a80e, 0xde6e9a059f7930a9561a551d13bf95c4a1d519b4, 0x93d310827047da2652e1b4537d7f45d8d8bf0c3d, 0x4c2f93ae9bba83da0b061df78df33d98bb1f45c5, 0x1de7301761ac60c07e4acb3645eed81d06c57fb5, 0xb0655c92bf75f63254ec70d7c1086e0f325b29de
Linked reports: Tether Frozen USDT-ERC20 Address