← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,559
Relationships
32,624
Potential duplicates
1
Filter by kind
Potential Duplicates
Entities with similar names that may refer to the same thing. Use the merge API to combine them.
substring match◎ forum.safefoundation.org↔◎ safefoundation.org457ed96b / b24f3db8
Merge instructions
curl -X POST /api/graph/merge \
-H "Authorization: Bearer $ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"keepId": "<entity-to-keep>", "mergeId": "<entity-to-remove>"}'Entities
↯df6230fe
Tether blacklists 26 cryptocurrency addresses associated with Cheil Credit Bank prior to OFAC's formal designation, an early compliance response that precedes official regulatory action.(2025-04-01:korea-mangyongdae-computer-technology-company)event
↯afa560f8
Lazarus Group executes the Bybit hack, stealing approximately $1.5 billion in a single operation using hybrid techniques combining embedded IT workers and credential theft.(2025-02-01:korea-mangyongdae-computer-technology-company)event
↯f4627d8d
OFAC sanctions Korea Osong Shipping Co. and Chonsurim Trading Corporation for sending DPRK IT workers to Laos, part of the expanding enforcement campaign against DPRK IT worker front companies.(2025-01-01:korea-mangyongdae-computer-technology-company)event
↯74c917ed
Cheil Credit Bank-linked cryptocurrency wallet addresses begin receiving sustained inbound flows. Over the subsequent two years (June 2023 – May 2025), these addresses collectively receive more than $12.7 million, reflecting patterns consistent with IT worker salary payments.(2023-06-01:korea-mangyongdae-computer-technology-company)event
↯ef42b399
OFAC and South Korea's Ministry of Foreign Affairs sanction Chinyong Information Technology Cooperation Company for employing DPRK IT workers abroad, a precedent action for the KMCTC designation.(2023-05-01:korea-mangyongdae-computer-technology-company)event
↯8ee1c45d
UN Sanctions Monitoring Team begins documenting DPRK IT worker revenue-generation schemes, later estimating $250–$600 million generated annually from this period onward.(2018-01-01:korea-mangyongdae-computer-technology-company)event
↯43ef8dab
Cheil Credit Bank (also known as First Credit Bank) first designated by OFAC on the SDN list, establishing a regulatory baseline for the banking infrastructure later used to launder KMCTC IT worker proceeds.(2017-09-01:korea-mangyongdae-computer-technology-company)event
□dbc46fcc
Korea Mangyongdae Computer Technology Companyorganization
↯c0f8612d
Chainalysis and Elliptic year-end reporting places total DPRK cryptocurrency theft in 2025 at approximately $2.02 billion — a record annual figure — out of $3.4 billion stolen across all actors globally. DPRK attacks account for 76% of all crypto service compromises by value.(2025-12-01:cheil-credit-bank)event
↯3d7b850b
Federal Register publishes formal notice of the November 4, 2025 OFAC sanctions action adding 53 cryptocurrency addresses to Cheil Credit Bank's SDN record.(2025-11-17:cheil-credit-bank)event
↯d651d3d7
U.S. Department of State issues concurrent statement describing Cheil Credit Bank's cryptocurrency network as part of the DPRK's sanctions-evasion architecture funding WMD and ballistic missile programs.(2025-11-04:cheil-credit-bank)event
↯a00213a0
FinCEN designates Huione Group as a primary money laundering concern under Section 311 of the U.S. Patriot Act. Cheil Credit Bank cryptocurrency addresses show on-chain exposure to Huione Pay and Huione Guarantee.(2025-05-01:cheil-credit-bank)event
↯47bdb6a3
Approximate start of Tether's proactive blocklisting operation targeting DPRK-linked addresses. 26 of the 53 Cheil Credit Bank cryptocurrency addresses are blocklisted by Tether in April–May 2025, freezing a portion of the active balances.(2025-04-01:cheil-credit-bank)event
↯aa14819d
North Korea's Lazarus Group hacks Bybit exchange for approximately $1.5 billion in cryptocurrency, the largest crypto heist in history. FBI confirms attribution to TraderTraitor/APT38. Funds are laundered through thousands of wallets and cross-chain bridges.(2025-02-21:cheil-credit-bank)event
↯ba1366cc
Australia designates Cheil Credit Bank under its DPRK Sanctions Regime.(2023-12-01:cheil-credit-bank)event
↯693117db
Approximate start of the period during which OFAC-designated Cheil Credit Bank cryptocurrency addresses began receiving USDT inflows consistent with IT worker salary disbursements. Activity would continue through May 2025.(2023-06-01:cheil-credit-bank)event
↯1fbc265f
Japan's Ministry of Finance independently designates Cheil Credit Bank under its own DPRK sanctions regime.(2017-11-07:cheil-credit-bank)event
↯d271bf97
OFAC designates Cheil Credit Bank (First Credit Bank) to the SDN list under E.O. 13810 for operating in North Korea's financial services sector. Bank is assigned SDN ID 22985 and DPRK4 program code.(2017-09-26:cheil-credit-bank)event
↯4ed62acf
President Trump signs Executive Order 13810, authorizing broad sanctions against North Korea's financial sector following DPRK's sixth nuclear test on September 3, 2017.(2017-09-21:cheil-credit-bank)event
□53d54f7f
Cheil Credit Bankorganization
↯0cd08bab
The Korea Times publishes detailed reporting on Quangvietdnbg's laundering methods, including Telegram channel operations (1,345 members), bulk Payoneer account purchases, and P2P crypto trading on Paxful and Facebook.(2026-04-16:amnokgang-technology-development-company)event
↯79774f50
Vietnam revokes business license of co-designated Quangvietdnbg International Services Company following U.S. sanctions announcement.(2026-03-13:amnokgang-technology-development-company)event
↯f12a38c2
OFAC designates Amnokgang Technology Development Company, co-designating Quangvietdnbg International Services Company and six individuals (Nguyen Quang Viet, Do Phi Khanh, Hoang Van Nguyen, Hoang Minh Quang, Yun Song Guk, York Louis Celestino Herrera). Seven Amnokgang cryptocurrency addresses across Ethereum and Tron are simultaneously designated.(2026-03-12:amnokgang-technology-development-company)event
↯1d7a2be1
York Louis Celestino Herrera, based in Spain, begins alleged collaboration with Yun Song Guk on IT service contracts connected to Amnokgang's labor export network.(2024-01-01:amnokgang-technology-development-company)event
↯50bfb694
DOJ indicts 14 DPRK nationals in connection with multi-year fraudulent IT worker schemes generating revenue for North Korea, providing judicial context for the broader network Amnokgang supports.(2024-12-01:amnokgang-technology-development-company)event
↯5a8ea80e
Nguyen Quang Viet (CEO of Quangvietdnbg) begins converting IT worker earnings to cryptocurrency for Amnokgang-linked North Korean nationals; the conversion activity spans approximately mid-2023 to mid-2025.(2023-07-01:amnokgang-technology-development-company)event
↯f2ea5fcd
Yun Song Guk begins leading Amnokgang-affiliated IT worker groups operating out of Boten, Laos (approximate start date per OFAC designation).(2023-06-01:amnokgang-technology-development-company)event
↯7907856e
OFAC initially designates Sim Hyon Sop, China-based representative of Korea Kwangson Banking Corp (KKBC), who later received funds connected to Amnokgang's IT worker network.(2023-04-01:amnokgang-technology-development-company)event
↯052b6094
OFAC sanctions Cheil Credit Bank, a DPRK financial institution later identified as a downstream recipient of Amnokgang-linked crypto flows.(2017-09-26:amnokgang-technology-development-company)event
↯a62da93c
Amnokgang Technology Development Company incorporated in Pyongyang, North Korea.(1982-01-01:amnokgang-technology-development-company)event
□eee19f97
Amnokgang Technology Development Companyorganization
◎74a877a2
elastic.codomain
↯1b25702c
Safe Foundation launched Safenet Beta at EthCC in Cannes, a decentralized transaction-security network using cryptographic attestations to address the blind-signing vulnerability class. Six genesis validators each staked a minimum of 3.5 million SAFE tokens.(2026-04-02:safe-wallet)event
↯3e252def
Rahul Rumalla joined the Safe ecosystem as VP of Product and Engineering; later became CEO of Safe Labs as the subsidiary took direct operational control of Safe{Wallet}.(2025-07-01:safe-wallet)event
↯7179d1d9
Approximately 86% of the stolen ETH had been converted to Bitcoin and dispersed across thousands of addresses, according to tracking by blockchain analytics firms.(2025-03-20:safe-wallet)event
↯3e15290d
Safe co-founder Martin Koeppelmann confirmed ten UI security improvements had been shipped, including displaying full raw transaction data and removing hardware wallet integrations that raised security concerns.(2025-03-03:safe-wallet)event
↯0b1eb66b
Safe Ecosystem Foundation published its official statement, confirming the developer machine compromise, confirming smart contracts were unaffected, and announcing full infrastructure rebuild and credential rotation.(2025-02-28:safe-wallet)event
↯95697f4b
FBI formally attributed the Bybit theft to North Korea's TraderTraitor threat group via IC3 public service announcement. Safe and Bybit issued competing statements on responsibility.(2025-02-26:safe-wallet)event
↯da981d52
Approximately two minutes after the malicious transaction was executed (~14:15 UTC), attackers uploaded clean JavaScript files back to Safe's AWS S3 bucket to erase forensic evidence.(2025-02-21:safe-wallet)event
↯efd4661c
Attackers injected malicious JavaScript into the file '_app-52c9031bfa03da47.js' in Safe's AWS S3 bucket. The payload was designed to activate only when Bybit's contract addresses were detected.(2025-02-19:safe-wallet)event
↯50e958cb
Attackers used the developer's extracted AWS credentials to access Safe's cloud infrastructure, hijacking an active session token to bypass MFA.(2025-02-05:safe-wallet)event
↯033abddd
A Safe{Wallet} developer's macOS workstation was compromised via social engineering. The developer downloaded a Docker project ('MC-Based-Stock-Invest-Simulator-main') containing malware that exploited a PyYAML RCE vulnerability.(2025-02-04:safe-wallet)event
Data refreshes within about 10 minutes · All metrics derived from Supabase