- Scam type: State-sponsored hacking
- Chain: Bitcoin
- Project or site name: North Korean APT38 (Lazarus Group): CoinsPaid, Alphapo and Poloniex heists
- Incident date: 2025-10-24
- Reported: 2026-10-28
- Last updated: 2026-10-28
A Justice Department civil forfeiture complaint filed October 24, 2025 attributes a series of virtual currency heists to North Korean military hacking groups known as the Lazarus Group and APT38. The complaint says the property it targets is traceable to the CoinsPaid, Alphapo and Poloniex heists, and that the actors laundered funds through bridges and the Sinbad mixer. It names these bitcoin addresses. Addresses: bc1pttac8lmptya5sal3djc4lsjujvt73fganctj53yglsqw69v036dqxruqnm bc1pnnhh3gkyvn4fth97x2j6tyd9p7mduz0sdl2vayn8g0yqqmuhxzzs9638ty Public bitcoin records show transaction history for…
Other addresses in this report: bc1pttac8lmptya5sal3djc4lsjujvt73fganctj53yglsqw69v036dqxruqnm, bc1pnnhh3gkyvn4fth97x2j6tyd9p7mduz0sdl2vayn8g0yqqmuhxzzs9638ty
Linked reports: Tether Frozen USDT-TRC20 Address (2024-06-17), Tether Frozen USDT-TRC20 Address (2024-06-17), Tether Frozen USDT-TRC20 Address (2024-06-17), Tether Frozen USDT-TRC20 Address (2024-06-18), Tether Frozen USDT-TRC20 Address (2024-06-18), Tether Frozen USDT-TRC20 Address (2024-06-18), Tether Frozen USDT-TRC20 Address (2024-06-18), Tether Frozen USDT-TRC20 Address (2024-06-18), Tether Frozen USDT-TRC20 Address (2024-06-17), Tether Frozen USDT-TRC20 Address (2024-06-17)