ZachXBT reveals North Korea's IT team using fake identities and cross-border accounts to launder over $3.5 million in crypto assets

ME News report. On April 8 (UTC+8), on-chain investigator ZachXBT disclosed that a North Korean IT professional’s device was infected with malware, resulting in the leakage of internal payment server data. The incident involved approximately 390 accounts, chat records, and encrypted transactions. The leaked data shows that the North Korean IT team reported income through its internal platform luckyguys.site, using large numbers of fabricated identities and false legal documents. They transferred cryptocurrency from exchanges or other services into wallets controlled by an administrator account, “PC-1234,” then exchanged it for fiat currency via China bank accounts and platforms such as Payoneer. Since November 2025, the related addresses have received over $3.5 million in payments, and one Tron address was frozen by Tether in December 2025. ZachXBT also published the network’s organizational structure, payment breakdowns, and some publicly verifiable addresses. (Source: PANews)