Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #1[disputed][awaiting moderator]in the summary

   “the April 2022 Ronin Network compromise”

   reviewerThe Ronin Network compromise occurred in April 2022Internal contradiction: the page's own timeline entry and Primary Attributed Incidents section both date the Ronin exploit to March 2022, but the summary says April 2022 — likely conflated with the April 18, 2022 AA22-108A advisory date, which is a separate event.
   Proposed correction (not yet applied)

   the March 2022 Ronin Network compromise
   citedwww.coindesk.com/tech/2022/03/29/axie-in…ers-625m-exploit
2. #2[disputed][awaiting moderator]in the summary

   “($620 million)”

   reviewerThe Ronin Network compromise totaled $620 millionThe page understates the figure by $5M relative to its own cited source and the broader contemporaneous reporting consensus of ~$625 million.
   Proposed correction (not yet applied)

   ($625 million)
   citedwww.coindesk.com/tech/2022/03/29/axie-in…ers-625m-exploit
3. #3[disputed][awaiting moderator]in section: Primary Attributed Incidents

   “Ronin Network / Axie Infinity ($620 million, March 2022): In March 2022, the Ronin Network bridge was exploited for approximately $620 million in ETH and USDC.”

   reviewerThe Ronin Network bridge was exploited for approximately $620 million in ETH and USDC in March 2022Date is correct in this section; only the dollar figure is off by $5M versus the cited source.
   Proposed correction (not yet applied)

   Ronin Network / Axie Infinity ($625 million, March 2022): In March 2022, the Ronin Network bridge was exploited for approximately $625 million in ETH and USDC.
   citedwww.coindesk.com/tech/2022/03/29/axie-in…ers-625m-exploit
4. #4[disputed][awaiting moderator]in section: Scale of Theft: Aggregate Figures

   “For 2022, the Ronin Network heist alone ($620 million) represented the single largest crypto theft at the time.”

   reviewerThe Ronin Network heist totaled $620 million, the largest 2022 crypto theftThird occurrence of the same $620M/$625M discrepancy.
   Proposed correction (not yet applied)

   For 2022, the Ronin Network heist alone ($625 million) represented the single largest crypto theft at the time.
   citedwww.coindesk.com/tech/2022/03/29/axie-in…ers-625m-exploit
5. #5[disputed][awaiting moderator]in the timeline

   “Ronin Network (Axie Infinity) bridge exploited for approximately $620 million in ETH and USDC.”

   reviewerRonin Network bridge was exploited for approximately $620 million in ETH and USDCThe timeline entry cites the same CoinDesk article by URL, which itself reports $625 million, not $620 million.
   Proposed correction (not yet applied)

   Ronin Network (Axie Infinity) bridge exploited for approximately $625 million in ETH and USDC.
   citedwww.coindesk.com/tech/2022/03/29/axie-in…ers-625m-exploit
6. #6[disputed][awaiting moderator]in section: DPRK IT Worker Infiltration (Adjacent Operation)

   “Five U.S. residents pleaded guilty in 2025 to facilitating the scheme under the DOJ's Operation DPRK Reload (DPRK RevGen initiative).”

   reviewerFive U.S. residents pleaded guilty in 2025 under a DOJ initiative called 'Operation DPRK Reload' (also called DPRK RevGen)A November 2025 Ars Technica report confirms five guilty pleas in a laptop-farm/IT-worker case, so that underlying fact checks out, but no program called 'Operation DPRK Reload' could be found in DOJ or news reporting — the real name is 'DPRK RevGen: Domestic Enabler Initiative.'
   Proposed correction (not yet applied)

   Five U.S. residents pleaded guilty in 2025 to facilitating the scheme under the DOJ's DPRK RevGen: Domestic Enabler Initiative.
   citedfortune.com/2025/08/04/north-korean-it-w…ations-exploded/
7. #7[disputed][awaiting moderator]in section: Money Laundering and Asset Dispersal

   “Chain analysis by Elliptic and TRM Labs documented the stolen ETH entering Tornado Cash in 28 separate deposits, with the group prioritizing speed and automation over traditional anonymity-maximizing behavior, in part due to heightened scrutiny on mixing infrastructure.”

   reviewerElliptic and TRM Labs documented the Bybit theft's stolen ETH entering Tornado Cash in 28 separate depositsBoth cited sources support the general 'spee and automation over mixing' framing but neither supports — and one directly undercuts — the specific claim that stolen ETH entered Tornado Cash in 28 separate deposits. No independent source was found for the '28' figure.
   Proposed correction (not yet applied)

   Elliptic and TRM Labs reported that the Bybit attackers largely bypassed conventional mixers such as Tornado Cash given the scale of the theft, with the group prioritizing speed and automation over traditional anonymity-maximizing behavior, in part due to heightened scrutiny on mixing infrastructure.
   citedwww.elliptic.co/blog/bybit-hack-largest-in-historywww.trmlabs.com/resources/blog/the-bybit…-largest-exploit

No source the reviewer could reach confirms or contradicts the claim.

1. #24[unverifiable][awaiting moderator]in section: Government Advisories and Sanctions

   “OFAC has sanctioned multiple cryptocurrency wallet addresses tied to North Korean operations, with the SDN list containing over 1,200 cryptocurrency addresses as of early 2025.”

   reviewerOFAC's SDN list contains over 1,200 cryptocurrency addresses tied to North Korean operations as of early 2025No source in the section's citation list speaks to this specific '1,200 cryptocurrency addresses' figure, and a targeted search did not turn up independent confirmation within the time available. Not contradicted, but not independently verified either.

The cited evidence supports part of the claim but not all of it.

1. #8[partially supported][awaiting moderator]in section: Attribution and Organizational Structure

   “A related but distinct North Korean cluster, UNC4736 (also tracked as Citrine Sleet / AppleJeus), is responsible for separate incidents such as the Drift Protocol hack; the two operate under the same RGB parent but employ different TTPs and target sets.”

   reviewerUNC4736 (Citrine Sleet / AppleJeus) is responsible for the Drift Protocol hackThe underlying premise (a distinct DPRK cluster separate from TraderTraitor behind Drift) is plausible and consistent with reporting, but the page states it as a settled fact ('is responsible for') when the best current sourcing describes it as a medium-high-confidence, not-yet-independently-confirmed attribution.
   citedcloud.google.com/blog/topics/threat-inte…e-alignment-2023
2. #9[partially supported][awaiting moderator]in section: Tactics, Techniques, and Procedures (TTPs)

   “The March 2026 UNC4899 breach of an unnamed cryptocurrency firm (described by The Hacker News) exemplifies this phase: a developer AirDropped a trojanized archive to a corporate device, which when executed spawned malware masquerading as the Kubernetes CLI tool, establishing a backdoor used to modify MFA policies, extract CI/CD service account tokens, tamper with Cloud SQL databases, and withdraw several million dollars in digital assets.”

   reviewerThe March 2026 UNC4899 breach of an unnamed cryptocurrency firm, with AirDrop-delivered trojan and Kubernetes/Cloud SQL tampering, is a confirmed UNC4899 operationTechnical narrative matches the source closely; the attribution confidence level ('moderate confidence,' per Google Cloud) is not reflected in the page's unqualified phrasing.
   citedthehackernews.com/2026/03/unc4899-used-a…ransfer-and.html
3. #10[partially supported][awaiting moderator]in the timeline

   “Google Threat Intelligence Group (formerly Mandiant) publishes report on UNC4899's breach of an unnamed cryptocurrency firm after a developer AirDropped a trojanized archive to a corporate device.”

   reviewerGoogle Threat Intelligence Group (formerly Mandiant) published the report on the March 2026 UNC4899 breachMinor publisher mislabeling plus the same unacknowledged confidence hedge as the sections[2] occurrence of this claim.
   citedthehackernews.com/2026/03/unc4899-used-a…ransfer-and.html

The cited evidence supports the claim as written.

1. #11[confirmed][no action needed]in section: Primary Attributed Incidents

   “On February 21, 2025, TraderTraitor actors stole approximately 400,000 ETH and staked ETH — worth approximately $1.5 billion at the time — from cryptocurrency exchange Bybit.”

   reviewerOn February 21, 2025, TraderTraitor stole approximately 400,000 ETH (~$1.5 billion) from Bybit via a Safe{Wallet} compromise, the largest crypto theft in historyWell-supported by tier-1 and tier-2 sources and broad independent reporting.
   citedwww.ic3.gov/psa/2025/psa250226www.cnbc.com/2025/02/21/hackers-steal-1p…rypto-heist.html
2. #12[confirmed][no action needed]in section: Primary Attributed Incidents

   “The FBI listed 51 Ethereum wallet addresses connected to the operation and urged virtual asset service providers to block transactions involving them.”

   reviewerFBI's IC3 PSA (Feb 26, 2025) listed 51 Ethereum wallet addresses tied to the Bybit theftConfirmed by direct count against the primary source.
   citedwww.ic3.gov/psa/2025/psa250226
3. #13[confirmed][no action needed]in the timeline

   “DMM Bitcoin (Japan) loses 4,502.9 BTC (~$308 million) after TraderTraitor actors use compromised session cookies to access Ginco's communications system and manipulate a legitimate DMM transaction.”

   reviewerDMM Bitcoin lost 4,502.9 BTC (~$308 million) in May 2024, attributed to TraderTraitor via Ginco compromiseThe $308M figure is the one used in official US reporting; some Japanese-sourced outlets round to $305M due to differing BTC/JPY conversion dates, but this is a rounding variance, not a contradiction of the page.
   citedwww.coindesk.com/policy/2024/12/24/north…pto-exchange-dmm
4. #14[confirmed][no action needed]in the timeline

   “UNC4899 (TraderTraitor) executes supply chain attack against JumpCloud, injecting malicious Ruby script into JumpCloud's command framework via spear phishing of JumpCloud employees. Fewer than five downstream cryptocurrency customers compromised. An OPSEC slip — direct connection from Pyongyang IP block — confirmed attribution.”

   reviewerUNC4899 compromised JumpCloud via a malicious Ruby script executed June 27, 2023, confirmed by a Pyongyang IP OPSEC slipClosely matches Mandiant's own account.
   citedcloud.google.com/blog/topics/threat-inte…rea-supply-chain
5. #15[confirmed][no action needed]in the timeline

   “FBI, CISA, and U.S. Treasury issue joint advisory AA22-108A formally naming 'TraderTraitor' as a North Korean state-sponsored APT targeting blockchain companies with trojanized cryptocurrency applications.”

   reviewerThe April 18, 2022 FBI/CISA/Treasury joint advisory AA22-108A first formally named 'TraderTraitor'Primary source confirmed live and consistent with claim.
   citedwww.cisa.gov/news-events/cybersecurity-a…sories/aa22-108a
6. #16[confirmed][no action needed]in the timeline

   “KelpDAO exploited for approximately $292 million. TRM Labs attributes the attack to TraderTraitor based on pre-funding analysis traceable to known TraderTraitor laundering networks. Approximately $175 million converted to Bitcoin via THORChain.”

   reviewerKelpDAO was exploited for ~$292 million on April 18, 2026, attributed to TraderTraitor by TRM Labs with ~$175 million laundered via THORChainClosely matches the cited TRM Labs blog post.
   citedwww.trmlabs.com/resources/blog/north-kor…just-two-attacks
7. #17[confirmed][no action needed]in the timeline

   “TRM Labs reports that North Korean hackers — including TraderTraitor — account for 76% of all crypto hack losses in the first four months of 2026, with $577 million stolen across two major attacks (KelpDAO and Drift Protocol).”

   reviewerThrough April 2026, North Korea-linked hackers stole $577 million (76% of global crypto hack losses) via KelpDAO and Drift ProtocolMatches multiple independent outlets (Yahoo Finance, Crowdfund Insider) reporting the same TRM Labs figures.
   citedwww.theblock.co/post/399569/north-korea-…billion-trm-labs
8. #18[confirmed][no action needed]in section: Scale of Theft: Aggregate Figures

   “According to Chainalysis's 2025 annual crypto crime report (published in late 2025 / January 2026), North Korea-linked actors stole $2.02 billion in cryptocurrency in 2025, a 51% year-over-year increase and a record high, accounting for approximately 60% of all reported global crypto theft that year.”

   reviewerChainalysis's 2025 report found North Korea stole $2.02 billion in 2025 (51% YoY increase, ~60% of global theft), with all-time total ~$6.75 billion since 2017Core figures directly confirmed; the 60% share and '2017' baseline are reasonable derived/standard figures not explicitly restated in this specific blog post, a minor gap rather than a contradiction.
   citedwww.chainalysis.com/blog/crypto-hacking-…olen-funds-2026/www.coindesk.com/business/2025/12/18/nor…chainalysis-says
9. #19[confirmed][no action needed]in the timeline

   “WazirX (India) loses approximately $234.9 million in digital assets from a multi-signature wallet. A joint statement by the U.S., South Korea, and Japan in January 2025 attributed the attack to North Korean Lazarus Group actors.”

   reviewerWazirX lost approximately $234.9 million in July 2024, attributed to North Korean Lazarus Group actors by a January 2025 US/South Korea/Japan joint statementConsistent across multiple independent outlets; the page's primary cited source is Wikipedia (credibility 3), but the claim checks out against higher-tier news coverage.
   citeden.wikipedia.org/wiki/2024_WazirX_hack
10. #20[confirmed][no action needed]in section: Money Laundering and Asset Dispersal

    “The DOJ's August 2025 conviction of Tornado Cash co-founder Roman Storm for running an unlicensed money transmission business is seen by researchers as an enforcement action targeting infrastructure used by groups including TraderTraitor.”

    reviewerRoman Storm, Tornado Cash co-founder, was convicted in August 2025 of running an unlicensed money transmission businessDate and charge match; the page does not claim conviction on the more serious deadlocked counts, so it is accurate as worded.
11. #21[confirmed][no action needed]in section: DPRK IT Worker Infiltration (Adjacent Operation)

    “The DOJ charged Matthew Isaac Knoot, a U.S. citizen in Nashville, for operating such a laptop farm.”

    reviewerDOJ charged Matthew Isaac Knoot, a U.S. citizen in Nashville, for operating a laptop farmMatches DOJ announcement and multiple outlets; page does not misstate the charge date since it gives none here.
    citedtechcrunch.com/2025/08/27/us-sanctions-f…and-steal-money/
12. #22[confirmed][no action needed]in section: Money Laundering and Asset Dispersal

    “Separately, North Korean hackers struck SBI Crypto for approximately $21 million in late 2025, routing stolen funds through Tornado Cash.”

    reviewerNorth Korean hackers stole approximately $21 million from SBI Crypto in late 2025, laundered through Tornado CashAmount, laundering route and rough timeframe ('late 2025' for a September event is a slightly loose characterization but defensible) check out; the North Korea attribution itself is investigator-sourced rather than government-confirmed, which the page's phrasing ('North Korean hackers struck') slightly overstates, though this is a minor hedge issue rather than a factual error.
13. #23[confirmed][no action needed]in section: DPRK IT Worker Infiltration (Adjacent Operation)

    “According to reporting by Fortune (August 2025), the number of companies that hired North Korean IT workers grew approximately 220% in the 12 months prior to the report, with infiltrations across more than 320 companies.”

    reviewerCompanies hiring North Korean IT workers grew ~220% in the 12 months before Fortune's August 2025 report, across 320+ companiesDirect headline match to the cited source.
    citedfortune.com/2025/08/04/north-korean-it-w…ations-exploded/