4 Arbitrum addresses a DOJ forfeiture complaint ties to a North Korean IT-worker theft (March 2024)
- Scam type: State-sponsored hacking
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: North Korean IT workers: March 15, 2024 theft from Company 1
- Incident date: 2025-01-06
- Reported: 2026-10-28
- Last updated: 2026-10-28
A Justice Department civil forfeiture complaint filed January 6, 2025 says North Korean IT workers use false identities to get remote developer jobs at virtual currency companies and then exploit those companies' smart contracts to steal funds. The complaint describes the March 15, 2024 theft of virtual currency from a company it calls Company 1 and the laundering that followed. It names these Arbitrum addresses. Addresses: 0xD6d4e8038DF50803412d1b1Ad2c9845BACf7c52b 0x76783b5387A3C95cc96442BF609d214547ED0cf4 0x563aBc82E814dA99C006d75b5b3381B23fA6F496 (the complaint says it was associated with…
Other addresses in this report: 0x76783b5387a3c95cc96442bf609d214547ed0cf4, 0x563abc82e814da99c006d75b5b3381b23fa6f496, 0xcc785304f9b651962f662ce7e8731ba85d15ac69
Linked reports: Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19)