Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #2[disputed][awaiting moderator]in section: Attribution and Organizational Structure

   “The MITRE ATT&CK framework catalogues the group as G1049 with associated software including POOLRAT and COLDCAT.”

   reviewerThe MITRE ATT&CK framework catalogues the group as G1049 with associated software including POOLRAT and COLDCATThe cited source itself does not support the specific claim that POOLRAT and COLDCAT are MITRE's catalogued 'associated software' for G1049 — only FRP holds that formal designation on the live page.
   Proposed correction (not yet applied)

   The MITRE ATT&CK framework catalogues the group as G1049; the group's only ATT&CK-catalogued Software entry is FRP (S1144), though POOLRAT and COLDCAT are documented in MITRE's narrative description of the group's 3CX campaign.
   citedattack.mitre.org/groups/G1049/

No source the reviewer could reach confirms or contradicts the claim.

1. #13[unverifiable][awaiting moderator]in section: Drift Protocol Exploit (April 2026, $285 Million)

   “Drift says $270 million exploit was a six-month North Korean intelligence operation — CoinDesk”

   reviewerDrift Protocol's post-mortem, published in a CoinDesk article, describes a $285 million exploitThe dollar figure used across sources for this incident ranges from $270M (CoinDesk headline) to $285M (The Hacker News, Bleeping Computer) to $286M (Elliptic) — likely reflecting evolving loss estimates over time rather than an error, but the page cites the $270M-headlined CoinDesk piece as a source for its $285M figure without reconciling the discrepancy, and I could not fetch the article body to check whether it was later corrected.
   citedwww.coindesk.com/markets/2026/04/05/drif…igence-operation
2. #18[unverifiable][awaiting moderator]in section: CVE-2024-7971 Chromium Zero-Day and FudModule Rootkit (August 2024)

   “Additional CVEs exploited by Citrine Sleet in related campaigns include CVE-2024-21338 (AppLocker driver zero-day used by FudModule 2.0) and CVE-2024-38193 (AFD.sys driver vulnerability).”

   reviewerAdditional CVEs exploited by Citrine Sleet in related campaigns include CVE-2024-21338 (AppLocker driver zero-day used by FudModule 2.0) and CVE-2024-38193 (AFD.sys driver vulnerability)The technical CVEs and their link to FudModule are well documented, but I could not find a credible source attributing this specific exploitation to Citrine Sleet as opposed to the broader Lazarus umbrella or the related Diamond Sleet cluster; the page's specific sub-cluster attribution could not be confirmed or refuted.
   citedwww.microsoft.com/en-us/security/blog/20…romium-zero-day/

The cited evidence supports part of the claim but not all of it.

1. #12[partially supported][awaiting moderator]in section: Drift Protocol Exploit (April 2026, $285 Million)

   “Once two contributors' devices were compromised, attackers obtained the multisig approvals needed for a durable nonce attack, with pre-signed transactions remaining dormant for over one week before execution on April 1.”

   reviewerThe Drift Protocol attack was executed via compromised contributor devices enabling a durable nonce attack, with pre-signed transactions dormant for over a week before executionThe page's account of the durable-nonce/multisig mechanic is directionally supported by the cited news sources, but omits the fake-collateral-token (CVT) mechanism that TRM Labs and Elliptic — both credible on-chain forensics firms — identify as the actual means by which real assets were extracted, and Elliptic offers a still different root-cause narrative (compromised admin keys). The page's technical account of 'how' the money was drained is incomplete relative to specialist on-chain-forensics reporting not currently cited on the page.
   citedthehackernews.com/2026/04/285-million-dr…aced-to-six.htmlwww.bleepingcomputer.com/news/security/d…erson-operation/
2. #17[partially supported][awaiting moderator]in section: Scope and Financial Impact

   “$2.2 Billion Stolen in Crypto in 2024 — Chainalysis”

   reviewerThe Chainalysis source used to support the DPRK-specific $1.3B/2024 figure is titled about a different ($2.2B total) statisticNot an error in the underlying fact, but the source list conflates a total-theft statistic with a DPRK-specific one; a reader following this specific link would not find the $1.3B DPRK figure stated there.
   citedwww.chainalysis.com/blog/crypto-hacking-…olen-funds-2025/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “Chainalysis estimates DPRK-linked actors have stolen at least $6.75 billion in cryptocurrency since 2016, with Citrine Sleet/UNC4736 operations accounting for multiple hundred-million-dollar individual incidents including the April 2026 Drift Protocol exploit ($285 million) and the October 2024 Radiant Capital breach ($50 million).”

   reviewerChainalysis estimates DPRK-linked actors have stolen at least $6.75 billion in cryptocurrency since 2016Both the $6.75B cumulative figure and the individual incident amounts are corroborated by multiple independent sources checked live.
   citedwww.chainalysis.com/blog/crypto-hacking-…olen-funds-2026/
2. #3[confirmed][no action needed]in section: Origin and Discovery: Operation AppleJeus (2018)

   “The attackers had created a fictitious company, 'Celas LLC,' with a fabricated Michigan business address, domain registration under a pseudonymous identity ('John Broox') via Domains4Bitcoins, and a valid SSL certificate from Comodo CA.”

   reviewerKaspersky discovered Operation AppleJeus via a fake company 'Celas LLC' using a Michigan address, 'John Broox' domain registrant, and Comodo SSL certificate, with an XOR key 'Moz&Wie;#t/6T!2y' and 'ko-kp' HTTP header artifactAll technical details in this section (XOR key, fake company registration details, ko-kp header) were independently verified against the cited Kaspersky Securelist report.
   citedsecurelist.com/operation-applejeus/87553/
3. #4[confirmed][no action needed]in section: Malware Arsenal and Technical Capabilities

   “sharing identical encryption key 'wLqfM]%wTx`~tUTbw>R^#yG5R(3C:;.' and matching function names (FConnectProxy, AcceptRequest) with earlier AppleJeus samples”

   reviewerPondRAT shares an identical encryption key and matching function names (FConnectProxy, AcceptRequest) with earlier AppleJeus/POOLRAT samplesVerified directly against the Unit 42 report text.
   citedunit42.paloaltonetworks.com/gleaming-pis…rat-and-pondrat/
4. #5[confirmed][no action needed]in section: PondRAT / Poisoned Python Packages Campaign (2024)

   “The packages — real-ids (893 downloads), coloredtxt (381 downloads), beautifultext (736 downloads), and minisound (416 downloads) — contained encoded payloads that downloaded and executed PondRAT”

   reviewerThe poisoned PyPI packages (real-ids, coloredtxt, beautifultext, minisound) had 893, 381, 736, and 416 downloads respectivelyExact figures confirmed against two independent secondary sources reporting on the same Unit 42 research.
   citedunit42.paloaltonetworks.com/gleaming-pis…rat-and-pondrat/thehackernews.com/2024/09/new-pondrat-ma…n-in-python.html
5. #6[confirmed][no action needed]in section: PondRAT / Poisoned Python Packages Campaign (2024)

   “Palo Alto Networks Unit 42 attributed a campaign distributing malicious Python packages via PyPI to Gleaming Pisces (Citrine Sleet) with medium confidence in September 2024.”

   reviewerUnit 42 attributed the PyPI/PondRAT campaign to Gleaming Pisces with medium confidenceConfidence level matches the source exactly.
   citedunit42.paloaltonetworks.com/gleaming-pis…rat-and-pondrat/
6. #7[confirmed][no action needed]in section: 3CX Supply Chain Attack (2022–2023)

   “The campaign shared technical indicators with prior AppleJeus operations including the RC4 key '3jB(2bsG#@c7' and the cookie variable '__tutma'.”

   reviewerMandiant attributed the 3CX supply chain compromise to UNC4736 with high confidence, sharing the RC4 key '3jB(2bsG#@c7' and cookie variable '__tutma' with prior AppleJeus operationsVerified against Mandiant's own published technical indicators.
   citedcloud.google.com/blog/topics/threat-inte…chain-compromise
7. #8[confirmed][no action needed]in section: 3CX Supply Chain Attack (2022–2023)

   “The 3CX DesktopApp is used by over 600,000 companies globally with 12 million daily users, making this one of the most impactful software supply chain attacks attributed to DPRK actors.”

   reviewerThe 3CX DesktopApp is used by over 600,000 companies globally with 12 million daily usersFigures match contemporaneous reporting on 3CX's user base.
   citedcloud.google.com/blog/topics/threat-inte…chain-compromise
8. #9[confirmed][no action needed]in section: Radiant Capital Breach (October 2024, $50 Million)

   “The attack chain began on September 11, 2024, when threat actors sent a malicious ZIP file via Telegram, impersonating a former contractor and requesting review of a security report on another crypto incident.”

   reviewerRadiant Capital: Sept 11, 2024 Telegram ZIP impersonating a former contractor delivered INLETDRIFT; Oct 16, 2024 breach drained ~$50M via three compromised developer devicesDates, malware name, and social-engineering pretext all corroborated by independent reporting.
   citedwww.coindesk.com/tech/2024/12/09/radiant…ttack-in-octobertherecord.media/radiant-capital-heist-north-korea
9. #10[confirmed][no action needed]in section: Radiant Capital Breach (October 2024, $50 Million)

   “Radiant Capital subsequently wound down operations after failing to recover or secure new funding, reducing from a peak of several hundred million dollars TVL to approximately $2 million.”

   reviewerRadiant Capital wound down operations, TVL falling from a peak of several hundred million dollars to approximately $2 millionTVL figure and wind-down outcome independently confirmed.
   citedcrypto.news/radiant-capital-to-wind-down…rea-linked-hack/
10. #11[confirmed][no action needed]in section: Drift Protocol Exploit (April 2026, $285 Million)

    “Two primary attack vectors were identified: (1) a malicious Microsoft VSCode/Cursor project weaponizing a 'tasks.json' file with the 'runOn: folderOpen' option to execute arbitrary code automatically upon opening — a technique North Korean actors adopted from approximately December 2025; and (2) a beta iOS wallet application distributed via Apple TestFlight, which bypasses App Store security review.”

    reviewerDrift Protocol lost approximately $285 million on April 1, 2026 via two attack vectors (VSCode/Cursor tasks.json and Apple TestFlight), attributed to UNC4736 with medium confidence based on fund-flow links to Radiant CapitalBoth technical vectors and the attribution linkage are independently confirmed.
    citedthehackernews.com/2026/04/285-million-dr…aced-to-six.htmlwww.coindesk.com/markets/2026/04/05/drif…igence-operation
11. #14[confirmed][no action needed]in section: U.S. Government Advisories and Sanctions

    “In May 2022, OFAC sanctioned the cryptocurrency mixer Blender.io — the first-ever designation of a virtual currency mixer — for providing mixing services to the Lazarus Group following the $625 million Ronin Network hack.”

    reviewerOFAC sanctioned Blender.io in May 2022 as the first-ever virtual currency mixer designation, tied to the $625 million Ronin Network hackCore facts (date, designation, nexus to Ronin/Lazarus) confirmed; the $625M figure is within normal reporting variance of Treasury's 'almost $620 million.'
    citedhome.treasury.gov/news/press-releases/sm924
12. #15[confirmed][no action needed]in section: U.S. Government Advisories and Sanctions

    “In April 2023, OFAC coordinated with South Korea to sanction OTC traders who converted stolen cryptocurrency for the Lazarus Group.”

    reviewerIn April 2023, OFAC coordinated with South Korea to sanction OTC traders who converted stolen cryptocurrency for the Lazarus GroupConfirmed, though the page's citation (home.treasury.gov/news/press-releases/sm924) is actually the September 2019 Lazarus Group designation press release, not the April 2023 OTC-trader release — a possible source mismatch worth checking on save.
    citedhome.treasury.gov/news/press-releases/sm924
13. #16[confirmed][no action needed]in section: Scope and Financial Impact

    “Chainalysis reported that DPRK-affiliated hackers stole $1.3 billion in cryptocurrency across 47 incidents in 2024 (a 103% year-over-year increase from $660.5 million across 20 incidents in 2023), and a record $2.02 billion in 2025.”

    reviewerChainalysis: DPRK-affiliated hackers stole $1.3 billion across 47 incidents in 2024, a 103% year-over-year increase from $660.5 million across 20 incidents in 2023Figures verified precisely against Chainalysis-sourced reporting.
    citedcointelegraph.com/news/north-korean-hack…2024-chainalysis
14. #19[confirmed][no action needed]in section: Fake Company and Social Engineering Infrastructure

    “The CISA/FBI/Treasury joint advisory (February 2021) documented seven distinct fake cryptocurrency trading companies linked to AppleJeus: Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, Dorusio, and Ants2Whale.”

    reviewerCISA/FBI/Treasury's February 2021 joint advisory documented seven distinct fake cryptocurrency trading companies: Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, Dorusio, and Ants2WhaleCompany list matches consistent, well-established public reporting on AA21-048A.
    citedwww.cisa.gov/news-events/cybersecurity-a…sories/aa21-048a
15. #20[confirmed][no action needed]in section: CVE-2024-7971 Chromium Zero-Day and FudModule Rootkit (August 2024)

    “Google patched CVE-2024-7971 on August 21, 2024, two days after Microsoft's discovery.”

    reviewerMicrosoft identified Citrine Sleet exploiting CVE-2024-7971 on August 19, 2024; Google patched it on August 21, 2024, two days laterTimeline is internally consistent with Microsoft's own account and contemporaneous reporting.
    citedwww.microsoft.com/en-us/security/blog/20…romium-zero-day/
16. #21[confirmed][no action needed]in the timeline

    “2024-10-16”

    reviewerRadiant Capital breach occurred on October 16, 2024 (timeline entry)Date confirmed against independent reporting.
    citedwww.coindesk.com/tech/2024/12/09/radiant…ttack-in-october
17. #22[confirmed][no action needed]in the timeline

    “OFAC formally sanctions the Lazarus Group as an agency or instrumentality of the Government of the DPRK.”

    reviewerOFAC formally sanctioned the Lazarus Group as an agency or instrumentality of the DPRK government on September 13, 2019Date and designation confirmed against the primary Treasury source.
    citedhome.treasury.gov/news/press-releases/sm924