`0x47597113c0d3cb6d6c9a0f6ba90d5f73b431b58f`

0x47597113c0d3cb6d6c9a0f6ba90d5f73b431b58f is a cryptocurrency wallet address that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from bbsz (@blackbigswan). The report is dated 2025-04-01.

wallet address IT Worker Fraud RESEARCHER POST

First seen 2025-04-01 · last seen 2025-04-01

Source

The report of 1 April 2025 finds the GitHub account SonataM hosting a large collection of copied memecoin websites, most likely for phishing or impersonation, each deployed to Vercel. Carried: the repositories, their deployments, and the values the report itself marks as fake: the Liquina pair it labels FAKE, the rug-pull pair and site liquina.vip, and the lookalike Liquina and Arky handles whose typos it points out.
www.ketman.org/one-north-korean-four-north-koreans.html — bbsz (@blackbigswan) · under “SonataM's copied memecoin sites (Ketman)” · published 2025-04-01 · pulled 2026-09-29

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: www.ketman.org/one-north-korean-four-north-koreans.html

bbsz (@blackbigswan) lists 52 other indicators in this source. 12 are shown, chosen across types.

All 53 indicators from this source