← Mach-O Man Malware Campaign (Lazarus / Chollima)reviewed 2026-10-17 · 24 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Mach-O Man Malware Campaign (Lazarus / Chollima) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
11 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #11[disputed][awaiting moderator]in the timeline
“2026-04-22”
reviewerArbitrum reportedly freezes $71 million in funds linked to the KelpDAO exploit on April 22, 2026The page's own cited source dates the freeze to April 20, 2026, not April 22. The $71M figure itself is correct; only the date field is wrong.Proposed correction (not yet applied)2026-04-20 - #13[disputed][awaiting moderator]in section: Regulatory Status and Sanctions
“sanctioned the Tornado Cash mixer on May 6, 2022, citing its use to launder DPRK-linked funds”
reviewerOFAC sanctioned the Tornado Cash mixer on May 6, 2022, citing its use to launder DPRK-linked fundsThe page's own cited URL (jy0768) is the Blender.io sanctions release, not Tornado Cash. The real Tornado Cash sanctions happened August 8, 2022, under a different press release, and are not covered anywhere on this page. This same conflation recurs in the section's source list, the timeline, and sources_used (see matching defect_group entries).Proposed correction (not yet applied)sanctioned the Blender.io mixer on May 6, 2022, citing its use to launder DPRK-linked funds from the Axie Infinity heist - #14[disputed][awaiting moderator]in section: Regulatory Status and Sanctions
“U.S. Treasury OFAC: First-Ever Sanctions on a Virtual Currency Mixer — Tornado Cash (2022)”
reviewerSource name: 'U.S. Treasury OFAC: First-Ever Sanctions on a Virtual Currency Mixer — Tornado Cash (2022)'Citation label names the wrong mixer; the press release at this URL is OFAC's first-ever mixer sanctions (Blender.io), not Tornado Cash.Proposed correction (not yet applied)U.S. Treasury OFAC: First-Ever Sanctions on a Virtual Currency Mixer — Blender.io (2022) - #15[disputed][awaiting moderator]in the timeline
“OFAC issues first-ever sanctions on a virtual currency mixer (Tornado Cash) citing its use to launder DPRK-linked proceeds.”
reviewerTimeline: OFAC issues first-ever sanctions on a virtual currency mixer (Tornado Cash)Same underlying conflation as the section text and source list.Proposed correction (not yet applied)OFAC issues first-ever sanctions on a virtual currency mixer (Blender.io) citing its use to launder DPRK-linked proceeds from the Axie Infinity heist. - #16[disputed][awaiting moderator]in the cited sources
“U.S. Treasury OFAC: First-Ever Sanctions on a Virtual Currency Mixer — Tornado Cash”
reviewerSource name in sources_used: 'U.S. Treasury OFAC: First-Ever Sanctions on a Virtual Currency Mixer — Tornado Cash'Fourth occurrence of the same underlying mislabeling.Proposed correction (not yet applied)U.S. Treasury OFAC: First-Ever Sanctions on a Virtual Currency Mixer — Blender.io - #18[disputed][awaiting moderator]in section: Regulatory Status and Sanctions
“A United Nations Panel of Experts report documented dozens of North Korean cyber operations over a five-year period netting an estimated $3 billion in stolen assets.”
reviewerA UN Panel of Experts report documented dozens of North Korean cyber operations over a five-year period netting an estimated $3 billionThe $3 billion figure and 'dozens' of operations (58) are both corroborated, but the time span is six years (2017-2023), not five, and no source for this sentence appears in the section's citation list at all.Proposed correction (not yet applied)A United Nations Panel of Experts report documented dozens of North Korean cyber operations over a six-year period netting an estimated $3 billion in stolen assets. - #20[disputed][awaiting moderator]in the summary
“Lazarus Group's cumulative cryptocurrency theft since 2017 is estimated to exceed $7.3 billion.”
reviewerLazarus Group's cumulative cryptocurrency theft since 2017 is estimated to exceed $7.3 billionInternal inconsistency: the summary says the cumulative total runs 'since 2017' while the body (sections[7]) says the same total runs '2019 through end-2025.' The cited source supports neither start year; it gives no start date at all. See matching defect_group entry in sections[7].Proposed correction (not yet applied)Lazarus Group's cumulative cryptocurrency theft is estimated to exceed $7.3 billion. - #21[disputed][awaiting moderator]in section: Scale of Lazarus Group Cryptocurrency Theft
“Prior to the April 2026 exploits, cumulative theft from 2019 through end-2025 was estimated at $6.75 billion by Chainalysis.”
reviewerPrior to the April 2026 exploits, cumulative theft from 2019 through end-2025 was estimated at $6.75 billion by ChainalysisEnd-point figure ($6.75B by end-2025) is supported; the '2019 through' start date is not in the cited source and contradicts the summary's unsupported 'since 2017' framing of the same metric.Proposed correction (not yet applied)Prior to the April 2026 exploits, cumulative theft through end-2025 was estimated at $6.75 billion by Chainalysis. - #22[disputed][awaiting moderator]in section: Scale of Lazarus Group Cryptocurrency Theft
“The CyberScoop analysis of the 2025 Bybit hack ($1.46 billion) noted that the scale and sophistication of Lazarus operations led analysts to describe the group as operating at 'institutional' speed and scale.”
reviewerCyberScoop's Bybit analysis described Lazarus as operating at 'institutional' speed and scaleThe dollar figure is accurate but the quoted characterization is not supported by the cited article.Proposed correction (not yet applied)The CyberScoop analysis of the 2025 Bybit hack ($1.46 billion) noted that analysts were struck by the unprecedented pace and scale of Lazarus's post-hack laundering operations. - #23[disputed][awaiting moderator]in section: Scale of Lazarus Group Cryptocurrency Theft
“Bybit CEO Ben Zhou stated post-hack that Lazarus laundered funds at a pace consistent with professional financial operations.”
reviewerBybit CEO Ben Zhou stated post-hack that Lazarus laundered funds at a pace consistent with professional financial operationsThis sentence misattributes a TRM Labs analyst's quote to Bybit's CEO; no such Zhou statement was found in the cited source or in a broader search of Zhou's public remarks on the hack.Proposed correction (not yet applied)Ari Redbord of TRM Labs, quoted by CyberScoop, said what set the hack apart was the extraordinary pace of Lazarus's post-hack laundering. - #24[disputed][awaiting moderator]in section: Scale of Lazarus Group Cryptocurrency Theft
“SpotedCrypto: Lazarus Group Stole $578M in 18 Days — Crypto's Worst Month Since Bybit”
reviewerSource: 'SpotedCrypto: Lazarus Group Stole $578M in 18 Days — Crypto's Worst Month Since Bybit'The source citation's title does not match the actual article headline. The underlying $575-578M combined Drift+KelpDAO figure used elsewhere on the page is reasonable, but the specific headline quoted here was not found on the source page.Proposed correction (not yet applied)SpotedCrypto: Lazarus Hit DeFi for $606M in 18 Days
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #9[stale][awaiting moderator]in section: Linked Exploits: Drift Protocol ($285M, April 1 2026)
“the largest DeFi hack of 2026 and the second-largest in Solana's history”
reviewerThe Drift Protocol exploit was the largest DeFi hack of 2026 and the second-largest in Solana's historyThis was true as originally reported on April 1-2, 2026, but is superseded by the page's own later KelpDAO section ($290-293M on April 18), which independent rankings (e.g. Halborn's monthly DeFi hack reviews) list as the larger 2026 incident.Proposed correction (not yet applied)one of the largest DeFi hacks of 2026 (second only to the KelpDAO exploit three weeks later) and the second-largest in Solana's history
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Campaign Overview and Attribution
“The campaign is attributed to Lazarus Group's Chollima (also tracked as Famous Chollima) division — a sub-cluster of North Korea's primary intelligence bureau, the Reconnaissance General Bureau (RGB).”
reviewerThe campaign is attributed to Lazarus Group's Chollima (also tracked as Famous Chollima) divisionLazarus attribution is solid, but equating 'Chollima' with 'Famous Chollima' as one and the same sub-division is contested; other reporting treats Famous Chollima as a distinct DPRK cluster. The page presents this nomenclature as settled when it is not.
confirmed
11 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Campaign Overview and Attribution
“The 'Mach-O Man' campaign was first publicly documented on April 21, 2026, by Mauro Eldritch of BCA LTD, building on analysis from Bitso's Quetzal Team and the ANY.RUN interactive sandbox.”
reviewerMach-O Man was first publicly documented on April 21, 2026 by Mauro Eldritch of BCA LTD, building on Bitso's Quetzal Team and ANY.RUNFully corroborated by the primary source. - #3[confirmed][no action needed]in section: Campaign Overview and Attribution
“The U.S. Treasury OFAC designated Lazarus Group, Bluenoroff, and Andariel as agencies or instrumentalities of the North Korean government on September 13, 2019.”
reviewerOFAC designated Lazarus Group, Bluenoroff, and Andariel as agencies/instrumentalities of the North Korean government on September 13, 2019Confirmed against the primary government source. - #4[confirmed][no action needed]in the timeline
“Lazarus Group established by the North Korean government, subordinate to the 110th Research Center, 3rd Bureau of the RGB, according to U.S. Treasury.”
reviewerLazarus Group was established by the North Korean government, subordinate to the 110th Research Center, 3rd Bureau of the RGBConfirmed verbatim against the primary source. - #5[confirmed][no action needed]in section: Technical Analysis: Four-Stage Attack Chain
“The Mach-O Man toolkit executes through four discrete stages.”
reviewerThe Mach-O Man toolkit executes through four discrete stages with the described binaries, persistence mechanism, endless-loop bug, RC4 encryption, and Go-http-client User-AgentTechnical details check out against the primary technical report. - #6[confirmed][no action needed]in section: Delivery Vector: ClickFix Social Engineering
“A DarkReading analysis noted Lazarus's pivot from traditional phishing exploits to this terminal-based social engineering approach as a significant tactical shift.”
reviewerThe campaign uses ClickFix social engineering via Telegram meeting invites, and DarkReading described this as a tactical shiftCould not retrieve full article text directly due to a 403, but indexed excerpts corroborate the claim. - #7[confirmed][no action needed]in section: Indicators of Compromise (IOCs)
“The Telegram bot tokens used for exfiltration were found to be operationally exposed, which enabled researchers to partially observe the C2 channel and reportedly disrupt aspects of the operation.”
reviewerANY.RUN's IOC report lists the stated domains, IPs, hashes, and notes exposed Telegram bot tokens enabled researchers to partially observe and disrupt the C2 channelCore claim about exposed bot tokens is confirmed by the primary technical source; the secondary Cybernews citation could not be directly checked. - #8[confirmed][no action needed]in section: Linked Exploits: Drift Protocol ($285M, April 1 2026)
“Attackers posing as a quantitative trading firm attended cryptocurrency conferences, built rapport with Drift contributors, established a Telegram group for trading strategy discussions, and deposited over $1 million into a vault to appear legitimate.”
reviewerDrift Protocol lost $285-295 million on April 1, 2026, via a six-month DPRK social-engineering operation, attributed with medium confidence to UNC4736, with a Radiant Capital linkAll specific operational details check out against the cited reporting. - #10[confirmed][no action needed]in section: Linked Exploits: KelpDAO Bridge ($290M+, April 2026)
“In mid-April 2026, KelpDAO suffered an exploit in which approximately 116,500 rsETH (valued at roughly $290–293 million) were released against a non-existent burn via a manipulated bridge mechanism.”
reviewerKelpDAO lost ~$290-293 million (116,500 rsETH) via compromised RPC nodes/DDoS and a 1-of-1 DVN; LayerZero/Chainalysis attribute it to Lazarus; funds routed through Tornado CashMatches the primary reporting closely. - #12[confirmed][no action needed]in the timeline
“OFAC sanctions two Chinese nationals for laundering cryptocurrency on behalf of Lazarus Group.”
reviewerOFAC sanctioned two Chinese nationals for laundering cryptocurrency on behalf of Lazarus Group on March 2, 2020Confirmed against the primary source and corroborating coverage (The Block, CyberScoop). - #17[confirmed][no action needed]in section: Regulatory Status and Sanctions
“The U.S. Department of Justice filed a complaint in August 2020 seeking forfeiture of 280 cryptocurrency addresses associated with North Korean exchange hackers, supported by Chainalysis blockchain tracing.”
reviewerThe U.S. DOJ filed a complaint in August 2020 seeking forfeiture of 280 cryptocurrency addresses associated with North Korean exchange hackers, supported by Chainalysis tracingConfirmed; month-level precision in the timeline (2020-08) is accurate even though the specific day was the 28th. - #19[confirmed][no action needed]in section: Scale of Lazarus Group Cryptocurrency Theft
“Chainalysis reported DPRK-linked actors stole approximately $2.02 billion in 2025 alone, a 51% year-over-year increase, representing roughly 76% of all service-related crypto thefts that year.”
reviewerChainalysis reported DPRK-linked actors stole approximately $2.02 billion in 2025, a 51% YoY increase, ~76% of service-related crypto thefts that yearFigures check out against independent reporting of the underlying Chainalysis data.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.