ZachXBT reveals North Korea's IT team using fake identities and cross-border accounts to launder over $3.5 million in crypto assets

ME News Report, April 8 (UTC+8), according to on-chain investigator ZachXBT, a North Korean IT worker’s device was infected with malware, and internal payment server data was leaked, involving approximately 390 accounts, chat records, and encrypted transactions.
The leaked data shows that the North Korean IT team reported income through the internal platform luckyguys.site, using numerous fake identities and false legal documents, transferring cryptocurrencies from exchanges or other services into wallets controlled by the administrator account “PC-1234,” then converting to fiat currency via Bank of China accounts and platforms like Payoneer.
Since November 2025, the relevant addresses have received over $3.5 million, with one Tron address frozen by Tether in December 2025.
ZachXBT also published the organizational structure, payment details, and some publicly accessible addresses of the network.
(Source: PANews)