ZachXBT disclosed data from an internal payment server used by North Korean IT workers, involving 390 accounts and over $3.5 million in funds.

According to ZachXBT, an anonymous source shared data stolen from an internal payment server in North Korea, covering 390 accounts, chat logs, and cryptocurrency transaction information. Since the end of November 2025, the related payment wallet addresses have received over $3.5 million, with funds transferred out through exchanges or converted into fiat currency and deposited into Chinese bank accounts via platforms such as Payoneer. On-chain tracking shows that the internal payment addresses are linked to known clusters of North Korean IT workers, and one of the Tron payment addresses was frozen by Tether in December 2025. Three related companies on the user list have been sanctioned by OFAC, including Sobaeksu. ZachXBT has compiled a complete organizational chart, with data covering the period from December 2025 to February 2026.