0xcf3f54b780ac180ed57f3227c96bcf9b2fd7415a
0xcf3f54b780ac180ed57f3227c96bcf9b2fd7415a is a cryptocurrency wallet address
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Multilateral Sanctions Monitoring Team (MSMT) and tayvano (lazarus-bluenoroff-research).
The earliest of those reports is dated 2025-10-22 and the most recent 2026-10-18.
wallet address IT Worker Fraud MATCHED IN SOURCE
Listed as Ethereum
Sources
-
…• 0xF9A d aC8658E08893fB4E91c1062e471 eb11Cb6c7 • 0xCF3f54b780aC180Ed57F3227C96BCF9B2FD7415A • 0xF9A d aC8658E08893fB4E91c1062e471eb11Cb6c7 The OTC trader then sent deposits to China UnionPay accounts registered to other…
The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities (MSMT 2025 2) — Multilateral Sanctions Monitoring Team (MSMT) -
…companies.  -  #### "Zhang Meihong" to China Accts - 0xCF3f54b780aC180Ed57F3227C96BCF9B2FD7415A - 0xF9AdaC8658E08893fB4E91c1062e471eb11Cb6c7 > Some DPRK cyber actors also maintain their own accounts at Chinese financial institutions…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.
Related indicators
Cited by the same report: The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities (MSMT 2025 2)
All 93 indicators from this source