ZachXBT Reveals North Korea IT Worker Internal Payment Server Data

DeepFlowTech · 2026-04-08T13:47:19+00:00

According to ZachXBT, an anonymous source leaked data from North Korea's payment servers, including 390 accounts and cryptocurrency transaction information, with over $3.5 million received since November 2025. These funds are linked to known North Korean IT professionals and involve companies sanctioned by OFAC.

DeepFlowTech

2026-04-08 13:47:19

Abstract generation in progress

Deep Tide TechFlow message, April 08, according to ZachXBT, a confidential source shared data stolen from North Korea’s internal payment servers, covering 390 accounts, chat logs, and encrypted cryptocurrency transaction information. From the end of November 2025 to the present, the related payment wallet addresses have received more than $3.5 million in total. The funds were either transferred out via exchanges or converted into fiat currency through platforms such as Payoneer and deposited into China bank accounts.

On-chain tracking shows that the internal payment addresses are linked to a known North Korean IT worker cluster, and one Tron payment address was frozen by Tether in December 2025. Among the user list, three associated companies have been sanctioned by OFAC, including Sobaeksu. ZachXBT has compiled a complete organizational chart, with data coverage spanning December 2025 to February 2026.

TRX1.26%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.