According to a disclosure by ZachXBT, an anonymous source shared data stolen from a North Korean internal payment server, covering 390 accounts, chat logs, and cryptocurrency transaction information. From late November 2025 to the present, the related payment wallet addresses have received over $3.5 million. The funds were transferred out via exchanges or converted into fiat currency through platforms like Payoneer and deposited into Chinese bank accounts.
On-chain tracking indicates that the internal payment addresses are linked to known clusters of North Korean IT workers. One Tron payment address was frozen by Tether in December 2025. Three associated companies in the user list have been sanctioned by OFAC, including Sobaeksu. ZachXBT has compiled a complete organizational chart, with the data covering the period from December 2025 to February 2026.