ZachXBT reveals internal payment server data of North Korean IT workers

According to ZachXBT, an anonymous source shared data stolen from North Korea's internal payment servers, covering 390 accounts, chat records, and cryptocurrency transaction information.

The related payment wallet addresses have received over $3.5 million from the end of November 2025 to the present, with funds transferred out through exchanges or converted into fiat currency via platforms like Payoneer and deposited into Chinese bank accounts.

On-chain tracking shows that the internal payment addresses are associated with known North Korean IT worker clusters, one of which had a Tron payment address frozen by Tether in December 2025. Three affiliated companies on the user list have been sanctioned by OFAC, including Sobaeksu. ZachXBT has compiled a complete organizational chart, with data covering from December 2025 to February 2026.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.