16 bitcoin addresses a DOJ forfeiture complaint ties to North Korean APT38 laundering of the HTX heist
- Scam type: State-sponsored hacking
- Chain: Bitcoin
- Project or site name: North Korean APT38: HTX heist laundering
- Incident date: 2025-11-14
- Reported: 2026-10-28
- Last updated: 2026-10-28
A Justice Department civil forfeiture complaint filed November 14, 2025 attributes virtual currency heists, including the theft from HTX (formerly Huobi), to the North Korean hacking group APT38. The complaint says the property it targets is traceable to the HTX heist and that the actors used Tornado Cash and CryptoMixer to launder proceeds. It names these bitcoin addresses. Addresses: bc1qwv0gm8c0d04snnfhnplkg9vla5uw7rnmwz5l0j bc1qasn7jp00fw85046yefwrypvdauag83ln59v764 bc1qtg3cyxg4yja4sut6uqkc8kmw2yyvt240srnh22 bc1qtsjzdefpw83h9uay7afgx9zg0rnan2dkecwtnp…
Other addresses in this report: bc1qwv0gm8c0d04snnfhnplkg9vla5uw7rnmwz5l0j, bc1qtg3cyxg4yja4sut6uqkc8kmw2yyvt240srnh22, bc1qtsjzdefpw83h9uay7afgx9zg0rnan2dkecwtnp, bc1qg37prnadsvvqy9glhfd5hu3sg4nuw6nqs2lt7p, bc1qeg855cyj85cmnm4qt9ax8ql5e97f2cegewquk3, bc1q690360gpc4sq8czs7626axvx4mpvajggzvzy3m, bc1qpkypyxtqqe7yg4xdh2c4c56hftr8fll5jsrv23, bc1q4a9a7pt7ku46d8a9yar5pxmd8rmrdhra0nwmt4, bc1qmf7zurt59c83rv3fs2mhxkehfhmvd8fztpf3mf, bc1q0l3qvstjmdvrfqsfcxuhj7r74wvqumnhgww5me, bc1q4zd2azutzpe9r5n4j9y87m5923cvszz60jwuv6, bc1qhe4vvepl7kh2wshau69e0acvt6nnwwuznzycv0, bc1q7ccmeq09lntnnl9tl6mj7uuxgrgk29mx5wwz55, bc1qpeeye558sl07ev2zgehupvjqfpc8nuykc4vplr, 147fx8ewYLH9EKqk1wqqgCXWJBwdVazEQ1
Linked reports: Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09), Tether Frozen USDT-TRC20 Address (2024-04-09)