North Korea’s Crypto Farce: $1M Monthly Pipeline Exposed by ZachXBT

by

Ah, the labyrinthine soul of man! How it revels in the shadows, in the clandestine corners of the digital underworld! Behold, on the eighth day of April, in the year 2026, the intrepid blockchain sleuth, ZachXBT, unfurled an 11-part tapestry of revelation, exposing the sinews of a North Korean payment server. A server, my dear reader, that had processed over $3.5 million since the waning days of November 2025. What a spectacle of human folly and greed!

Key Takeaways (or, as I prefer, the crumbs from the feast of corruption):

  • ZachXBT’s April 8 exposé laid bare a DPRK IT worker payment server, a veritable fountain of $3.5 million since late November 2025.
  • Three OFAC-sanctioned entities-Sobaeksu, Saenal, and Songkwang-emerged from the shadows of luckyguys.site, a domain as absurd as it is sinister.
  • The internal DPRK site, like a wounded beast, retreated into the darkness on April 9, 2026, but not before ZachXBT had archived its secrets, a digital trophy of his triumph.

North Korean Hackers and the Password of Infamy: ‘123456’

The data, my friends, was pilfered from a DPRK IT worker’s device, compromised by the cunning infostealer malware. An anonymous source, no doubt a whisper in the wind, delivered the files to ZachXBT, who confirmed their virginity-untainted by public eyes. The records, a trove of 390 accounts, IPMsg chat logs, fabricated identities, browser history, and cryptocurrency transactions, painted a portrait of desperation and ingenuity.

The heart of this drama was luckyguys.site, or WebMsg, as its architects called it-a Discord-esque messenger where DPRK IT workers whispered their financial secrets to their handlers. And what a comedy of errors! At least ten users, in their infinite wisdom, retained the default password: “123456.” Oh, the profundity of human laziness!

The user list, a roster of Korean names, cities, and coded group names, echoed the known operations of DPRK IT workers. Among them, Sobaeksu, Saenal, and Songkwang-entities sanctioned by the U.S. Treasury’s Office of Foreign Assets Control. A trifecta of villainy, if ever there was one.

Payments were confirmed through the central admin account, PC-1234. ZachXBT, ever the meticulous investigator, shared direct messages from a user named “Rascal,” whose transfers were tied to fraudulent identities from December 2025 to April 2026. Some messages even referenced Hong Kong addresses, though their authenticity remains as elusive as a shadow at noon.

The payment wallet addresses, a digital river of wealth, received over $3.5 million during this period-roughly $1 million per month. Workers, armed with forged documents and fake identities, secured employment, and crypto flowed like water, either directly from exchanges or converted to fiat through Chinese bank accounts via platforms like Payoneer. PC-1234, the omnipresent admin, confirmed receipt and distributed credentials for various crypto and fintech platforms.

Onchain analysis, that modern oracle, tied the internal payment addresses to known clusters of DPRK IT workers. Two addresses stood out: an Ethereum address and a Tron address, the latter frozen by Tether in December 2025. A small victory in the grand chess game of finance.

ZachXBT, with the precision of a surgeon, mapped the organizational structure of the network, including payment totals per user and per group. He published an interactive org chart covering December 2025 through February 2026 at investigation.io/dprk-itw-breach, accessible with the password “123456.” A fitting touch, is it not?

The compromised device and chat logs revealed further intricacies. Workers employed Astrill VPN and fake personas to apply for jobs. Internal Slack discussions included a post from “Nami,” sharing a blog about a DPRK worker deepfake applicant. The admin, ever diligent, sent 43 Hex-Rays and IDA Pro training modules to workers between November 2025 and February 2026, covering disassembly, decompilation, and debugging. One link, in particular, addressed unpacking hostile PE executables-a masterclass in digital subterfuge.

Thirty-three DPRK IT workers communicated through the same IPMsg network. Log entries hinted at plans to steal from Arcano, a GalaChain game, using a Nigerian proxy, though the outcome remains shrouded in mystery. ZachXBT characterized this cluster as less sophisticated than higher-tier DPRK groups like Applejeus or Tradertraitor. He noted that low-tier groups attract threat actors due to low risk and minimal competition-a haven for the moderately ambitious.

The luckyguys.site domain, like a ghost in the machine, vanished on Thursday, the day after ZachXBT’s revelations. He confirmed the full dataset was archived before its demise, a digital monument to his prowess.

This investigation, my dear reader, offers a glimpse into the soul of DPRK IT worker cells-how they collect payments, maintain fake identities, and move money through crypto and fiat systems. A spectacle of scale and operational gaps, a ballet of greed and desperation. And yet, in this digital underworld, one cannot help but marvel at the absurdity of it all. The password “123456”-a testament to the human condition, is it not?

Read More

2026-04-09 16:28