One Solana address a DOJ forfeiture complaint names in laundering of a North Korean SOL theft (March 2024)

• Scam type: State-sponsored hacking
• Chain: Solana
• Project or site name: North Korean IT workers: March 29, 2024 SOL theft from users of U.S. Company 1
• Incident date: 2025-01-21
• Reported: 2026-10-28
• Last updated: 2026-10-28

A Justice Department civil forfeiture complaint filed January 21, 2025 says that on March 29, 2024 North Korean actors moved SOL from the wallets of users of a company it calls U.S. Company 1 to 32 threat-actor-controlled wallets. The complaint says that on March 31, 2024 the funds went to several instant exchanges, including FixedFloat and EasyBit, and that most of the SOL was consolidated at the FixedFloat deposit address below before being swapped for USDT and ETH. Addresses: 5ndLnEYqSFiA5yUFHo6LVZ1eWc6Rhh11K5CfJNkoHEPs (the complaint calls it a FixedFloat deposit address) Public Solana…