tanuki42

1/8 It's likely that the market maker @DWFLabs was compromised in September 2022 by a DPRK-affiliated threat actor called AppleJeus, resulting in a theft of at least $44M+ composed predominantly of USDC and USDT.

As of November 2025, DWF has not publicly confirmed any incident.

Meet Nick Franklin @0xNickLFranklin - Blockchain Security Engineer…. or RGB operative hacking for DPRK? Seemingly this guy has had the entire industry fooled for years.

1/ Very pleased to have played a small role in finally taking down @exchcx – one of the most prolific services used for money laundering in the past year. eXch was a hub for DPRK, CSAM vendors, script kiddies, scammers, and many more bad actors laundering the money.

1/ Thought it might be helpful to translate this for crypto folks so you know who is hacking you.

tl;dr the word "Lazarus" doesn't mean anything anymore, it's just a collective name used to describe various North Korean cyber operations. The (relevant) clusters are as follows:

1/ This will probably be controversial, but I’ve been wanting to share my personal thoughts on this case for a long time and I think it is an important discussion crypto needs to have: Samourai Wallet vs Tornado Cash and why conflating these two cases is bad for privacy.

Are we literally not even pretending anymore? "THORChain(NEW CRYPTO LAUNDERING TOOL)" - @BitgetWallet @THORChain

This persona is extremely developed and has seemingly interacted with many major security researchers, protocols and services. It is yet another lesson that EVERYONE should be paranoid - you have probably already spoken to North Korean operatives, and have absolutely no idea.

etherscan.io/tx/0x670c405ce…

Angel Drainer affiliate tries to remove @tether blacklist on their account 🤣🤣

Pleased to help get a result here for the victim and always a pleasure working with @zachxbt and @CFInvestigators, some of the best in the business 🤝

Earlier today, @k06a flagged that this account had sent him a suspicious file and was not to be trusted. It seems Anton’s diligence may have prevented an extremely serious compromise… @tayvano_ and I have spent the last few hours digging into Mr Franklin’s Telegram history and

Next time you visit Europe, be sure to check out Poland City, Poland - "Top Digital Nomad Destination" as recommended by DPRK IT Worker, Damian Mularz 💯

If you have interacted with this persona and are AT ALL concerned that you are at risk, please reach out to me, @tayvano_ or SEAL-911 (t.me/seal_911_bot) ASAP.

So @gardenfi got hacked for at least $11M+ likely (TBC) by a DPRK-affiliated group known as DangerousPassword.

Somewhat ironically, of the $5.3M which appears stolen on Solana (account: WZy4xxpqktWa1b6MPMRiWsD487CT8mDcapB6GufBJCH), over 50% is sourced from the @swissborg hack...

Looking this address up in our notes, we noticed that this address was also involved in something else -> It was a signer on two safes, on BSC and Arbitrum: 0xcCfE10Cbc381dD6752fA34253a17e7e7c0cf7951. This exact Safe was used for testing in another incident… the hack against

11/ FIOD just posted a pretty based message on eXch's infamous Bitcointalk page:

bitcointalk.org/index.php?topi…

I've spoken to >20 companies in the last month about hiring these guys - some of which are major players in the space.

If you think this is never going to affect you, it likely already does.

Read this thread, be aware, and please for the love of god, meet your co-founders IRL.

I don't care how decentralized your protocol is—if most of the volume is just stolen funds being laundered, you haven’t built utility. You’ve built a playground for thieves.

10/ P.S. Big shout out to Johann who for years gave us the ability to determine which addresses were eXch deposit addresses despite absolute denial that the service ever made use of Thorchain. Thank you for your service 🫡.

However… when we started to look at his old account (TgID: 6513796713) we noticed something absolutely CRAZY. On August 30th 2024, this account had sent a message to a Sepolia faucet Telegram group (t.me/sepolia_testne…) seemingly to receive some testnet ETH:

I am absolutely sick to death of DeFi protocols flexing record volumes when the majority of their usage is coming from illicit activity.

@gardenfi has made millions of dollars in protocol fees from laundering funds stolen by DPRK affiliated groups and they are not alone.