TPwXAPwYaDCm7GrzNFiMmNnofrxEVURXRM
TPwXAPwYaDCm7GrzNFiMmNnofrxEVURXRM is a cryptocurrency wallet address
that one published source reports
in connection with APT38 activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from ZachXBT (@zachxbt).
The report is dated 2026-10-05.
wallet address APT38 RESEARCHER POST
Source
-
The researcher describes posing as a client, from March 2025, of a Chinese over-the-counter laundering syndicate that told him it had moved most of the $1.5B taken from Bybit in February 2025, an exploit attributed to the North Korean group TraderTraitor. His contact used the alias Jimmy Green on Telegram (account ID 7635649994) and gave him these Ethereum, Tron and Solana addresses for the swaps; the first Ethereum address was funded with gas from an address on the public Bybit exploit blacklist, the three Solana addresses exposed a cluster of more than $12M of exploit funds swapped from Bitcoin through Ethereum and Solana to Tron, and 0x652d7f9e... is the address Tether froze 442K USDT at. The addresses belong to the launderers rather than to North Korean operators, which is why they are recorded without a persona. The Telegram username printed in the thread is not carried: in a reply the researcher says the account was deleted earlier in 2026 and someone else has since claimed the username, so it would now point at an unrelated account. His own funding address in the fourth post is not an indicator and is not carried either. Read on 26 October 2026, all 12 posts of the thread and the 121 replies; no reply adds a value.
x.com/zachxbt/status/2107081652631712160 — ZachXBT (@zachxbt)
Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.