0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 is a cryptocurrency wallet address
that one published source reports
in connection with APT38 activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from ZachXBT (@zachxbt).
The report is dated 2026-10-30.
wallet address APT38 RESEARCHER POST
Source
-
The researcher reports that the Arbitrum Security Council, on which he is a signer, froze about $30.5M from the Binance exploit held at the first address, which he names as the exploiter's, and later that funds from the $6.3B Binance exploit and the $388M Bitget exploit were commingled at the second address after arriving through THORChain. He writes that this indicates the same actor is likely behind both incidents, that the Bitget exploit was attributed to the DPRK-linked TraderTraitor, and in a reply in the same thread that the Binance exploit is likely Lazarus Group. On 12 November 2026 the Justice Department announced that the FBI attributes the theft of about $6 billion from Binance on or about 29 October to the North Korean actors it calls TraderTraitor (https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency); the addresses themselves are the researcher's. Another researcher, tanuki42, replying the same day (https://x.com/tanuki42_/status/2116030971925475471), judges the commingling address more likely a third-party laundering service handling the proceeds of both thefts, predominantly Chinese money-laundering organisations, than an account controlled by North Korea; the second address may therefore belong to launderers rather than operators. Read on 12 November 2026 with the thread and its replies; no reply adds a value.
x.com/zachxbt/status/2115960582230913357 — ZachXBT (@zachxbt)
Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.