ZachXBT Reveals North Korean IT Worker Inner Platform: Monthly Revenue Around $1 Million, Involving Identity Fraud and Legal Document Forgery

April 8: On-chain sleuth ZachXBT disclosed that an anonymous tipster has provided stolen data from a North Korean internal payment server—including 390 accounts, chat logs, and cryptocurrency transaction records. The data relates to a sophisticated fraud network with an estimated $1 million monthly turnover, involving identity fraud, forged legal documents, and crypto-to-fiat conversion channels. The North Korean IT workers’ internal payment platform operates like Discord, used for reporting to superiors and processing payments. Its default password ("123456") had not been changed for an extended period. User lists include roles, North Korean names, cities, and group codes, and link to three OFAC-sanctioned entities: Sobaeksu, Saenal, and Songkwang. From late November 2025 to the present, the platform’s payment wallets have received over $3.5 million total. Typical payment flows involve workers transferring crypto from exchanges or using services like Payoneer to move fiat via bank accounts; the administrator ("PC-1234") provides account credentials only after confirming receipt. Organizational charts outline total payments per user and group, plus the group’s other activities and internal details: using Astrill for firewall bypass, fake identities for job applications, Slack discussions, and sharing reverse-engineering training materials. Some chat logs show North Korean IT workers discussing stealing project funds via Nigerian agents, though it remains unconfirmed whether this was carried out.