← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
31,232
Relationships
34,109
Potential duplicates
0
Filter by kind
Entities
↯454f65ae
AppleJeus malware samples dated June–August 2018 deployed against a cryptocurrency exchange in Asia via trojanized 'Celas Trade Pro' application from fake company 'Celas LLC.' First documented macOS malware deployment by Lazarus Group.(2018-06-01:citrine-sleet-applejeus)event
□91ff838b
Citrine Sleet / AppleJeusorganization
↯489f9f16
TRM Labs reports that North Korean hackers — including TraderTraitor — account for 76% of all crypto hack losses in the first four months of 2026, with $577 million stolen across two major attacks (KelpDAO and Drift Protocol).(2026-04-30:tradertraitor-unc4899)event
↯3d2decc2
KelpDAO exploited for approximately $292 million. TRM Labs attributes the attack to TraderTraitor based on pre-funding analysis traceable to known TraderTraitor laundering networks. Approximately $175 million converted to Bitcoin via THORChain.(2026-04-18:tradertraitor-unc4899)event
↯fb9efa74
Google Threat Intelligence Group (formerly Mandiant) publishes report on UNC4899's breach of an unnamed cryptocurrency firm after a developer AirDropped a trojanized archive to a corporate device. Attackers used living-off-the-cloud techniques to steal several million dollars via Kubernetes and Cloud SQL tampering.(2026-03-09:tradertraitor-unc4899)event
↯9c97525c
Chainalysis publishes 2025 crypto crime report, attributing $2.02 billion in cryptocurrency theft to North Korean actors — a record high — accounting for approximately 60% of all global crypto theft in 2025. Cumulative DPRK-attributed theft reaches approximately $6.75 billion since 2017.(2025-12-18:tradertraitor-unc4899)event
↯c3b4c6d0
Lazarus Group adopts ClickFix social engineering technique to deliver GolangGhost malware to cryptocurrency job seekers, as documented by security researchers. The campaign targets both Windows and macOS users via fake video interview platforms.(2025-04-01:tradertraitor-unc4899)event
↯5ce326c9
FBI issues IC3 PSA I-022625-PSA formally attributing the Bybit theft to North Korea's TraderTraitor, listing 51 Ethereum wallet addresses and urging industry to block related transactions.(2025-02-26:tradertraitor-unc4899)event
↯822b2b63
Bybit cold wallet transfer intercepted after TraderTraitor actors compromise a Safe{Wallet} developer machine and inject malicious JavaScript into the Safe{Wallet} AWS S3-hosted frontend. Approximately 400,000 ETH (~$1.5 billion) stolen — the largest cryptocurrency theft in history.(2025-02-21:tradertraitor-unc4899)event
↯f840ab48
FBI, DC3, and Japan's NPA issue joint attribution statement formally linking TraderTraitor to the $308 million DMM Bitcoin theft. This is the first formal government attribution of a specific TraderTraitor incident to a named currency theft.(2024-12-24:tradertraitor-unc4899)event
↯6c91d5b7
WazirX (India) loses approximately $234.9 million in digital assets from a multi-signature wallet. A joint statement by the U.S., South Korea, and Japan in January 2025 attributed the attack to North Korean Lazarus Group actors.(2024-07-18:tradertraitor-unc4899)event
↯bcc2c08e
DMM Bitcoin (Japan) loses 4,502.9 BTC (~$308 million) after TraderTraitor actors use compromised session cookies to access Ginco's communications system and manipulate a legitimate DMM transaction.(2024-05-31:tradertraitor-unc4899)event
↯9e545b2e
TraderTraitor actor posing as LinkedIn recruiter contacts Ginco employee with malicious Python script disguised as a pre-employment coding test, initiating the attack chain that ultimately leads to the $308 million DMM Bitcoin theft.(2024-03-28:tradertraitor-unc4899)event
↯74b04d08
UNC4899 (TraderTraitor) executes supply chain attack against JumpCloud, injecting malicious Ruby script into JumpCloud's command framework via spear phishing of JumpCloud employees. Fewer than five downstream cryptocurrency customers compromised. An OPSEC slip — direct connection from Pyongyang IP block — confirmed attribution.(2023-06-27:tradertraitor-unc4899)event
↯aa073b5f
Ronin Network (Axie Infinity) bridge exploited for approximately $620 million in ETH and USDC. FBI later formally attributed the attack to Lazarus Group / APT38 (overlapping with TraderTraitor). Initial access traced to a fake job offer PDF delivered to a Sky Mavis engineer.(2022-03-23:tradertraitor-unc4899)event
↯76ef1cf9
FBI, CISA, and U.S. Treasury issue joint advisory AA22-108A formally naming 'TraderTraitor' as a North Korean state-sponsored APT targeting blockchain companies with trojanized cryptocurrency applications.(2022-04-18:tradertraitor-unc4899)event
□0cb31fd4
TraderTraitor / UNC4899organization
↯df638966
OFAC issues a new round of sanctions targeting six individuals and two entities for DPRK IT worker fraud schemes, including Amnokgang Technology Development Company. The action confirms that the IT worker enforcement campaign continues beyond the November 2025 KMCTC designation.(2026-03-12:korea-mangyongdae-computer-technology-company)event
↯74cc91f0
The U.S. and members of the Multilateral Sanctions Monitoring Team (MSMT) at the United Nations publish a report highlighting the DPRK's violations and evasions of UN sanctions through cyber and IT worker activities, referencing the broader ecosystem in which KMCTC operates.(2026-01-01:korea-mangyongdae-computer-technology-company)event
↯ca96b98f
North Korea-linked hackers are reported to have stolen approximately $2.02 billion in cryptocurrency in 2025 — a 51% year-over-year increase — pushing the DPRK's all-time theft total to an estimated $6.75 billion.(2025-12-01:korea-mangyongdae-computer-technology-company)event
↯454bec78
Federal Register publishes OFAC's formal notice of the sanctions action (document 2025-19924), providing the official public record of KMCTC's SDN designation.(2025-11-17:korea-mangyongdae-computer-technology-company)event
↯eb7f130f
U.S. Department of State issues a concurrent statement on disrupting illicit DPRK bankers and institutions laundering cybercrime and IT worker funds, reinforcing the Treasury action with a foreign policy framing.(2025-11-04:korea-mangyongdae-computer-technology-company)event
↯df6230fe
Tether blacklists 26 cryptocurrency addresses associated with Cheil Credit Bank prior to OFAC's formal designation, an early compliance response that precedes official regulatory action.(2025-04-01:korea-mangyongdae-computer-technology-company)event
↯afa560f8
Lazarus Group executes the Bybit hack, stealing approximately $1.5 billion in a single operation using hybrid techniques combining embedded IT workers and credential theft.(2025-02-01:korea-mangyongdae-computer-technology-company)event
↯f4627d8d
OFAC sanctions Korea Osong Shipping Co. and Chonsurim Trading Corporation for sending DPRK IT workers to Laos, part of the expanding enforcement campaign against DPRK IT worker front companies.(2025-01-01:korea-mangyongdae-computer-technology-company)event
↯74c917ed
Cheil Credit Bank-linked cryptocurrency wallet addresses begin receiving sustained inbound flows. Over the subsequent two years (June 2023 – May 2025), these addresses collectively receive more than $12.7 million, reflecting patterns consistent with IT worker salary payments.(2023-06-01:korea-mangyongdae-computer-technology-company)event
↯ef42b399
OFAC and South Korea's Ministry of Foreign Affairs sanction Chinyong Information Technology Cooperation Company for employing DPRK IT workers abroad, a precedent action for the KMCTC designation.(2023-05-01:korea-mangyongdae-computer-technology-company)event
↯8ee1c45d
UN Sanctions Monitoring Team begins documenting DPRK IT worker revenue-generation schemes, later estimating $250–$600 million generated annually from this period onward.(2018-01-01:korea-mangyongdae-computer-technology-company)event
↯43ef8dab
Cheil Credit Bank (also known as First Credit Bank) first designated by OFAC on the SDN list, establishing a regulatory baseline for the banking infrastructure later used to launder KMCTC IT worker proceeds.(2017-09-01:korea-mangyongdae-computer-technology-company)event
□dbc46fcc
Korea Mangyongdae Computer Technology Companyorganization
◎340ec1c8
38north.orgdomain
↯c0f8612d
Chainalysis and Elliptic year-end reporting places total DPRK cryptocurrency theft in 2025 at approximately $2.02 billion — a record annual figure — out of $3.4 billion stolen across all actors globally. DPRK attacks account for 76% of all crypto service compromises by value.(2025-12-01:cheil-credit-bank)event
↯3d7b850b
Federal Register publishes formal notice of the November 4, 2025 OFAC sanctions action adding 53 cryptocurrency addresses to Cheil Credit Bank's SDN record.(2025-11-17:cheil-credit-bank)event
↯d651d3d7
U.S. Department of State issues concurrent statement describing Cheil Credit Bank's cryptocurrency network as part of the DPRK's sanctions-evasion architecture funding WMD and ballistic missile programs.(2025-11-04:cheil-credit-bank)event
↯a00213a0
FinCEN designates Huione Group as a primary money laundering concern under Section 311 of the U.S. Patriot Act. Cheil Credit Bank cryptocurrency addresses show on-chain exposure to Huione Pay and Huione Guarantee.(2025-05-01:cheil-credit-bank)event
↯47bdb6a3
Approximate start of Tether's proactive blocklisting operation targeting DPRK-linked addresses. 26 of the 53 Cheil Credit Bank cryptocurrency addresses are blocklisted by Tether in April–May 2025, freezing a portion of the active balances.(2025-04-01:cheil-credit-bank)event
↯aa14819d
North Korea's Lazarus Group hacks Bybit exchange for approximately $1.5 billion in cryptocurrency, the largest crypto heist in history. FBI confirms attribution to TraderTraitor/APT38. Funds are laundered through thousands of wallets and cross-chain bridges.(2025-02-21:cheil-credit-bank)event
↯ba1366cc
Australia designates Cheil Credit Bank under its DPRK Sanctions Regime.(2023-12-01:cheil-credit-bank)event
↯693117db
Approximate start of the period during which OFAC-designated Cheil Credit Bank cryptocurrency addresses began receiving USDT inflows consistent with IT worker salary disbursements. Activity would continue through May 2025.(2023-06-01:cheil-credit-bank)event
↯1fbc265f
Japan's Ministry of Finance independently designates Cheil Credit Bank under its own DPRK sanctions regime.(2017-11-07:cheil-credit-bank)event
↯d271bf97
OFAC designates Cheil Credit Bank (First Credit Bank) to the SDN list under E.O. 13810 for operating in North Korea's financial services sector. Bank is assigned SDN ID 22985 and DPRK4 program code.(2017-09-26:cheil-credit-bank)event
↯4ed62acf
President Trump signs Executive Order 13810, authorizing broad sanctions against North Korea's financial sector following DPRK's sixth nuclear test on September 3, 2017.(2017-09-21:cheil-credit-bank)event
□53d54f7f
Cheil Credit Bankorganization
↯0cd08bab
The Korea Times publishes detailed reporting on Quangvietdnbg's laundering methods, including Telegram channel operations (1,345 members), bulk Payoneer account purchases, and P2P crypto trading on Paxful and Facebook.(2026-04-16:amnokgang-technology-development-company)event
↯79774f50
Vietnam revokes business license of co-designated Quangvietdnbg International Services Company following U.S. sanctions announcement.(2026-03-13:amnokgang-technology-development-company)event
↯f12a38c2
OFAC designates Amnokgang Technology Development Company, co-designating Quangvietdnbg International Services Company and six individuals (Nguyen Quang Viet, Do Phi Khanh, Hoang Van Nguyen, Hoang Minh Quang, Yun Song Guk, York Louis Celestino Herrera). Seven Amnokgang cryptocurrency addresses across Ethereum and Tron are simultaneously designated.(2026-03-12:amnokgang-technology-development-company)event
↯1d7a2be1
York Louis Celestino Herrera, based in Spain, begins alleged collaboration with Yun Song Guk on IT service contracts connected to Amnokgang's labor export network.(2024-01-01:amnokgang-technology-development-company)event
↯50bfb694
DOJ indicts 14 DPRK nationals in connection with multi-year fraudulent IT worker schemes generating revenue for North Korea, providing judicial context for the broader network Amnokgang supports.(2024-12-01:amnokgang-technology-development-company)event
↯5a8ea80e
Nguyen Quang Viet (CEO of Quangvietdnbg) begins converting IT worker earnings to cryptocurrency for Amnokgang-linked North Korean nationals; the conversion activity spans approximately mid-2023 to mid-2025.(2023-07-01:amnokgang-technology-development-company)event
Data refreshes within about 10 minutes · All metrics derived from Supabase