Verify a decision

{"actor":"system:backfill","investigation_id":"b2a77313-9c2a-4017-a3c4-ffb6a37a4fad","kind":"publish","page_slug":"superteam","published_at":"2026-05-30T12:21:31.077Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Superteam","sections":[{"content":"","heading":"","severity":"low","sources":[{"credibility":2,"name":"Superteam Official Website","type":"official","url":"https://superteam.fun/"},{"credibility":2,"name":"Superteam on Solana: Project Review, Programs, Token, Metrics | Solana Compass","type":"research","url":"https://solanacompass.com/projects/superteam"},{"credibility":2,"name":"Solana Foundation USA Grants | Superteam Earn","type":"official","url":"https://superteam.fun/earn/grants/solana-foundation-usa-grants"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"ZachXBT Telegram — Investigations (searched, no Superteam posts found)","type":"social_media","url":"https://t.me/s/investigations"},{"credibility":3,"name":"ZachXBT on X (@zachxbt)","type":"social_media","url":"https://x.com/zachxbt"},{"credibility":2,"name":"ZachXBT Mirror publication","type":"other","url":"https://zachxbt.mirror.xyz/"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":2,"name":"ZachXBT on X — $16.58M in DPRK IT worker payments since Jan 2025","type":"social_media","url":"https://x.com/zachxbt/status/1940388827392344261"},{"credibility":1,"name":"DPRK IT Workers Expanding in Scope and Scale | Google Cloud Blog","type":"research","url":"https://cloud.google.com/blog/topics/threat-intelligence/dprk-it-workers-expanding-scope-scale"},{"credibility":2,"name":"North Korean IT Workers Infiltrated European Solana-Based Projects: Google — Decrypt","type":"news_article","url":"https://decrypt.co/312797/north-korean-it-workers-infiltrated-european-solana-based-projects-google"},{"credibility":2,"name":"ZachXBT: Solana DeFi App ElementalDeFi Hired DPRK IT Worker for Years | BanklessTimes","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/04/07/zachxbt-solana-defi-app-elementaldefi-hired-dprk-it-worker-for-years/"},{"credibility":2,"name":"ZachXBT uncovers North Korea-linked IT worker network generating $1M monthly | The Block","type":"news_article","url":"https://www.theblock.co/post/396847/zachxbt-uncovers-north-korea-linked-it-worker-network-generating-1m-monthly-via-crypto-payment-flows"},{"credibility":2,"name":"Solana DEX Stabble urges liquidity exit after alleged DPRK mole revealed | Protos","type":"news_article","url":"https://protos.com/solana-dex-stabble-urges-liquidity-exit-after-alleged-dprk-mole-revealed/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"BIG JO on X — Superteam Earn crime allegation thread (Feb 2025)","type":"social_media","url":"https://x.com/__BigJo/status/1897186206028599307"},{"credibility":3,"name":"Superteam Earn Customer Reviews (2025) | Product Hunt","type":"community_report","url":"https://www.producthunt.com/products/superteam-earn/reviews"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"Superteam Official Website — organizational structure","type":"official","url":"https://superteam.fun/"},{"credibility":2,"name":"Superteam Earn | The Superteam Handbook","type":"official","url":"https://docs.superteam.fun/the-superteam-handbook/products/superteam-earn"},{"credibility":1,"name":"Solana Foundation Grants and Funding Program","type":"official","url":"https://solana.org/grants-funding"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":1,"name":"Solana Projects in Europe Being Targeted by North Korea, Google Cloud Warns | CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/04/02/google-warns-solana-projects-that-north-koreans-are-increasingly-targeting-european-projects"},{"credibility":2,"name":"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation | Hacker News","type":"news_article","url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"},{"credibility":1,"name":"ZachXBT names Axiom in investigation into alleged employee insider trading | The Block","type":"news_article","url":"https://www.theblock.co/post/391423/zachxbt-investigation-into-alleged-employee-insider-trading"},{"credibility":2,"name":"Solana DEX Stabble Warns Users to Pull Liquidity After North Korean Hacker Scare | Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/solana-exchange-stabble-warns-users-212034923.html"}]}],"sources_used":[{"credibility":2,"name":"Superteam Official Website","type":"official","url":"https://superteam.fun/"},{"credibility":2,"name":"Superteam on Solana — Solana Compass","type":"research","url":"https://solanacompass.com/projects/superteam"},{"credibility":2,"name":"Superteam Earn Platform","type":"official","url":"https://earn.superteam.fun/"},{"credibility":2,"name":"ZachXBT on X — DPRK payment investigation thread","type":"social_media","url":"https://x.com/zachxbt/status/1940388827392344261"},{"credibility":1,"name":"DPRK IT Workers Expanding in Scope and Scale — Google Cloud Blog","type":"research","url":"https://cloud.google.com/blog/topics/threat-intelligence/dprk-it-workers-expanding-scope-scale"},{"credibility":2,"name":"ZachXBT uncovers North Korea-linked IT worker network generating $1M monthly — The Block","type":"news_article","url":"https://www.theblock.co/post/396847/zachxbt-uncovers-north-korea-linked-it-worker-network-generating-1m-monthly-via-crypto-payment-flows"},{"credibility":2,"name":"ZachXBT: Solana DeFi App ElementalDeFi Hired DPRK IT Worker for Years — BanklessTimes","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/04/07/zachxbt-solana-defi-app-elementaldefi-hired-dprk-it-worker-for-years/"},{"credibility":2,"name":"Solana DEX Stabble urges liquidity exit after alleged DPRK mole — Protos","type":"news_article","url":"https://protos.com/solana-dex-stabble-urges-liquidity-exit-after-alleged-dprk-mole-revealed/"},{"credibility":2,"name":"North Korean IT Workers Infiltrated European Solana-Based Projects — Decrypt","type":"news_article","url":"https://decrypt.co/312797/north-korean-it-workers-infiltrated-european-solana-based-projects-google"},{"credibility":1,"name":"Solana Projects in Europe Being Targeted by North Korea, Google Cloud Warns — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/04/02/google-warns-solana-projects-that-north-koreans-are-increasingly-targeting-european-projects"},{"credibility":2,"name":"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation — Hacker News","type":"news_article","url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"},{"credibility":1,"name":"ZachXBT names Axiom in investigation into alleged employee insider trading — The Block","type":"news_article","url":"https://www.theblock.co/post/391423/zachxbt-investigation-into-alleged-employee-insider-trading"},{"credibility":2,"name":"ZachXBT Uncovers $3.5M Operation by North Korean Fake Devs Inside Crypto Firms — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/zachxbt-uncovers-3-5m-operation-by-north-korean-fake-devs-inside-crypto-firms/"},{"credibility":1,"name":"Solana Foundation Grants and Funding","type":"official","url":"https://solana.org/grants-funding"},{"credibility":3,"name":"BIG JO on X — Superteam Earn crime allegation (Feb 2025)","type":"social_media","url":"https://x.com/__BigJo/status/1897186206028599307"},{"credibility":3,"name":"Superteam Earn Product Hunt listing","type":"community_report","url":"https://www.producthunt.com/products/superteam-earn"},{"credibility":2,"name":"ZachXBT Investigations Telegram Channel","type":"social_media","url":"https://t.me/s/investigations"}],"summary":"Superteam is a community-run talent network and grant accelerator operating as the contributor layer of the Solana ecosystem, founded by Tanmay Bhat and Akshay BD and active across 23+ global chapters. The organization has been flagged for investigation by ZachXBT, though no published, verifiable ZachXBT post or report specifically naming Superteam as a fraudulent entity was located during this investigation; the exact nature and basis of that flag remains unconfirmed. Separately, Superteam Earn — the organization's public freelance bounty and job platform — operates within a segment of the Solana ecosystem that regulators, Google Cloud threat intelligence, and on-chain investigators have identified as systematically targeted by DPRK-linked IT workers using false identities.","timeline":[{"date":"2021-01-01","event":"Superteam founded by Tanmay Bhat and Akshay BD as a community DAO to support Solana ecosystem builders, initially focused on India.","source":"Superteam Official Website / Solana Compass","source_url":"https://solanacompass.com/projects/superteam"},{"date":"2022-01-01","event":"Superteam Earn launched as a platform aggregating Solana bounties, grants, and freelance job listings; escrow payment system implemented.","source":"Superteam Earn Product Hunt listing","source_url":"https://www.producthunt.com/products/superteam-earn"},{"date":"2024-08-15","event":"ZachXBT publicly alleges that a single entity in Asia (possibly North Korea) employs 21 developers working on 25+ crypto projects, earning $500K/month. DPRK targeting of Solana-adjacent platforms documented.","source":"ZachXBT on X / CoinTelegraph","source_url":"https://www.tradingview.com/news/cointelegraph:00777747d094b:0-zachxbt-claims-21-north-korea-crypto-devs-are-making-500k-a-month/"},{"date":"2025-02-01","event":"Social media posts allege fraud and non-payment by projects listed on Superteam Earn, with one post claiming 'the crime that goes on on superteam earn is out of this world.' Superteam-affiliated account defends the platform's role as a neutral marketplace.","source":"X/Twitter — @__BigJo","source_url":"https://x.com/__BigJo/status/1897186206028599307"},{"date":"2025-04-02","event":"Google Cloud Threat Intelligence Group warns that North Korean IT workers are specifically targeting European Solana projects and Solana job boards, expanding from previous US-focused operations.","source":"CoinDesk / Google Cloud Blog","source_url":"https://www.coindesk.com/markets/2025/04/02/google-warns-solana-projects-that-north-koreans-are-increasingly-targeting-european-projects"},{"date":"2025-06-01","event":"ZachXBT traces the $680,000 Favrr exploit to DPRK operatives who had posed as legitimate developers; CTO 'Alex Hong' identified as North Korean. DPRK developer infiltration of Solana projects escalates.","source":"ZachXBT / CryptoPotato","source_url":"https://cryptopotato.com/zachxbt-uncovers-3-5m-operation-by-north-korean-fake-devs-inside-crypto-firms/"},{"date":"2026-02-26","event":"ZachXBT publishes investigation into insider trading at Axiom, a Solana trading platform — another Solana-adjacent platform fraud case.","source":"The Block","source_url":"https://www.theblock.co/post/391423/zachxbt-investigation-into-alleged-employee-insider-trading"},{"date":"2026-04-01","event":"Drift Protocol on Solana exploited for $285 million in a confirmed DPRK-attributed six-month social engineering operation, the largest Solana hack to date.","source":"Hacker News / TRM Labs / Chainalysis","source_url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"},{"date":"2026-04-07","event":"ZachXBT alleges ElementalDeFi, a Solana DeFi project, hired a DPRK IT worker for years using a false identity. Stabble, a Solana DEX, urgently warns liquidity providers after a former employee is identified as a North Korean operative who also worked for Elemental.","source":"BanklessTimes / Protos","source_url":"https://www.banklesstimes.com/articles/2026/04/07/zachxbt-solana-defi-app-elementaldefi-hired-dprk-it-worker-for-years/"}]},"v":1}