OS

Investigations @ zeroShadow
Global Regulations
AML lead

@zeroshadow_io

[OS @Crypt0Sm1th]

@circle @Lighter_xyz @Lighter_xyz if you ever get hacked, just know that @circle will never step in to save your funds

[OS @Crypt0Sm1th]

@Fiskantes Whilst that 344 million is unrelated. Tether did movenfastnto freeze 383k USD of Kelp Funds whennwe tracked it yesterday

[tanuki42 @tanuki42_]

You could have used your admin key on HALTETHCHAIN to instantly stop North Korea (or any bad actor) swapping from Ethereum at any time before February 10th, 2025. Likewise same with any other chain.

Sure, after some co-ordination, the nodes could have overridden (says a lot about the THORChain community that you think this would happen) - but:

a) that's not a reason to not act and,
b) I thought you wanted to remove admin privileges anyway? #decentralization and that

[Tay 💖 @tayvano_]

DeFi just rugged DPRK of $70M.

This was surely an insane undertaking by a massive amt of people.

I want to say thank you to EVERYONE who played a role. Including those who pushed back.

Great things rise from tension, from the hard moments.

This is DeFi.

DeFi fucking wins.🫡

[ZachXBT @zachxbt]

@jerallaire How come the Arc block explorer shows that dprk.arc minted this North Korean propaganda NFT to your public address jerallaire.arc?

Transaction hash:
https://t.co/Ej802MlM5H

[OS @Crypt0Sm1th]

@DerrickYeo61993 @zachxbt @DerrickYeo61993

It would be good to understand MEXC's stance when law enforcement do reach out, at times MEXC say that they can not provide any information due to the account data belonging to another jurisdiction. You then provide email addresses and close the case.....

[zeroShadow @zeroshadow_io]

XMR has been spiking, but is it all for the privacy narrative? We don't think so (1/2)

[Tay 💖 @tayvano_]

You fully failed your client.

Your excuses about censorship are absurd and are nothing but lazy moral justification of your own failings.

You knew it was a scam and you failed to communicate effectively and prevent the inevitable. That’s 100% on you.

Our customer support team has been doing a better job than you at helping these people for years now. Wtaf.

Don’t ever onboard someone again. You’re completely fucking insane if you think this is an acceptable outcome. It’s not.

[tanuki42 @tanuki42_]

1/8 It's likely that the market maker @DWFLabs was compromised in September 2022 by a DPRK-affiliated threat actor called AppleJeus, resulting in a theft of at least $44M+ composed predominantly of USDC and USDT.

As of November 2025, DWF has not publicly confirmed any incident.

[zeroShadow @zeroshadow_io]

We're excited to announce zeroShadow is bolstering @SeiNetwork Labs security ⚡️

What we're delivering:
🔒 24/7/365 vSOC Coverage
🔎Web3 Threat Mitigation
🤝Security Consulting
🚀Rapid Incident Response

Our supports brings enterprise level protection to one of the most innovative ecosystems in the industry.

[sudo rm -rf --no-preserve-root / @pcaversaccio]

alright, after a week of work you can now fully simulate Safe transactions _locally_ before signing and verify the transaction hashes in parallel using my `safe-tx-hashes-util` with a single command (use the `--simulate flag` simply). This lets you check exactly how the transaction will execute before you sign. Everything is local. Everything what is executed is printed in the terminal. Transparency at all cost. You trust your RPC provider here so use a trusted endpoint or the preferred solution of running your own node. I know many still do not believe me but local-first, cli-based verification is the way to go. Not hosted UIs. My verification script is _one_ fucking Bash file. Everyone can audit it by looking at exactly one file. No dependency bloat.

[zeroShadow @zeroshadow_io]

zeroShadow monitors all DPRK activity round the clock in our efforts to reduce harm in the blockchain ecosystem. Today our investigators identified a suspicious bridge transaction onto BNB Chain that was later linked to the $AIO exploit (32M tokens drained Sept 1). In collaboration with @_SEAL_Org and @binance , we moved fast to alert exchanges. This resulted in freezing attacker-controlled assets + halting AIO trading, limiting further market damage. This case shows how blockchain transparency + rapid private sector action can track + disrupt DPRK cyber operations in real time.

[OS @Crypt0Sm1th]

@NoahBPerlman @ARedbord @NoahBPerlman then why can't we start recognising and creating partnerships with private security firms that have been doing this for years?

[Anna Giaritelli @Anna_Giaritelli]

---THREAD---

This is the most important story I’ve told. It’s my story. I’ve waited five years to share it, and I’m ready now.

I’m Anna Giaritelli. The DC police are covering up crime. I know because they covered up what happened to me.

https://t.co/yk5N7j7XQ9

[tanuki42 @tanuki42_]

1/ This looks likely to be a great example of something I see a lot - bad actors complaining publicly on social media to try and get their funds unfrozen.

In this case, I applaud @ChangeNOW_io for not bowing to these people and insisting on a proper due diligence process here.

[zeroShadow @zeroshadow_io]

🧵North Korea Laundered $1 Billion in Crypto in 4 Months. How Industry Leaders Can Change Crypto Freezes and Recovery

[OS @Crypt0Sm1th]

@DeFi_Cheetah @GMX_IO @circle Circle on freeze with Court order. Takes weeks for that to come in

[OS @Crypt0Sm1th]

@paoloardoino Any chance we can get more signers on multisig so thay we can blacklist quicker

[tanuki42 @tanuki42_]

1/ Very pleased to have played a small role in finally taking down @exchcx – one of the most prolific services used for money laundering in the past year. eXch was a hub for DPRK, CSAM vendors, script kiddies, scammers, and many more bad actors laundering the money.

[OS @Crypt0Sm1th]

@krakenfx @coinbureau @krakenfx wish you would stop shitpostong and help @zeroshadow_io save your customers from hetting scammed