ZachXBT reveals internal payment server data of North Korean IT workers

According to ZachXBT, an anonymous source shared data stolen from North Korea's internal payment servers, covering 390 accounts, chat records, and cryptocurrency transaction information.

The related payment wallet addresses have received over $3.5 million from the end of November 2025 to the present, with funds being withdrawn through exchanges or converted into fiat currency via platforms like Payoneer and deposited into Chinese bank accounts. On-chain tracking shows that the internal payment addresses are linked to known North Korean IT worker clusters, with one Tron payment address having been frozen by Tether in December 2025. Three affiliated companies in the user list have been sanctioned by OFAC, including Sobaeksu. ZachXBT has compiled a complete organizational chart, with data covering from December 2025 to February 2026.