- Scam type: State-sponsored hacking
- Chain: Solana
- Project or site name: North Korean IT workers: August 2024 theft from Company 1
- Incident date: 2025-08-05
- Reported: 2026-10-28
- Last updated: 2026-10-28
A Justice Department civil forfeiture complaint filed August 5, 2025 says North Korean IT workers pose as non-North Korean nationals to get remote jobs, including at virtual currency platforms, and sometimes use that access to steal virtual currency. The complaint says the FBI attributed a theft from a company it calls Company 1, in or around August 2024, to North Korean IT workers. It names these Solana addresses. Addresses: 7ANPW36t8LekXXS1jACir59RGvnCAacxKFH9Zq6tW4UZ 6USfQ9BX33LNvuR44TXr8XKzyEgervPcF4QtZZfWMnet Public Solana records show transaction history for both addresses. Sources: DOJ…
Other addresses in this report: 7ANPW36t8LekXXS1jACir59RGvnCAacxKFH9Zq6tW4UZ, 6USfQ9BX33LNvuR44TXr8XKzyEgervPcF4QtZZfWMnet
Linked reports: Tether Frozen USDT-ERC20 Address