- Scam type: State-sponsored hacking
- Chain: Solana
- Project or site name: North Korean IT workers: March 15, 2024 theft from Company 1
- Incident date: 2025-01-06
- Reported: 2026-10-28
- Last updated: 2026-10-28
A Justice Department civil forfeiture complaint filed January 6, 2025 says North Korean IT workers use false identities to get remote developer jobs at virtual currency companies and then exploit those companies' smart contracts to steal funds. The complaint describes the March 15, 2024 theft of virtual currency from a company it calls Company 1 and the laundering that followed. It names these Solana addresses. Addresses: CPp4ZGwk22XwdWaRa99NdoXM68xJ8XgkPy22LymzBgaK 9cHPoCzekfxozVEdBqrjsnt3kuWoHMDR5fkWnGobTnqN Hq2bPMuGKamdafHs9EUvD6aaamn9ctM1oUKtHTi38ot1…
Other addresses in this report: CPp4ZGwk22XwdWaRa99NdoXM68xJ8XgkPy22LymzBgaK, 9cHPoCzekfxozVEdBqrjsnt3kuWoHMDR5fkWnGobTnqN, Hq2bPMuGKamdafHs9EUvD6aaamn9ctM1oUKtHTi38ot1, 4NY1c8S5YN6jVdPTEZ7VRTWPm2kAi1QtcYuhpqXKYJia, BAdMy9mfJ8fU9uWNS25CCPhT1fc8ELgsz94wvoMuXF6, 9zVYZ3LViQvroY2nfDwDrynnxewMz287o3qvcr8h5D75, 6bZKwpSwVaSqpdpQqmKzkAz4SmKR4YiSyRafawZuSARB, Ec9PKkYKVXviDPBEKKB8FaJb9umgCWfLHEFdFRQumNBd, Cs2kjqTQZXmGU2mB4g5vGGJFbmABZpuEv93LsbcEHAe2, Gv7885sAb2D1hKMWpxCZMqmFmWKU3E4bursTNCzZaDF4, 398HeJhyuVGqsaeUY4RCXrKuaiGxu8s1wH3QubXJtiZW, ASTyfSima4LLAdDgoFGkgqoKowG1LZFDr9fAQrg7iaJZ, J2v6ZjoaNbPGRHAMDHtDJjF3dT47SocCn64SxponE3tA
Linked reports: Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19), Tether Frozen USDT-TRC20 Address (2024-03-19)