October 03, 2026
This is not news. The indictment was filed in the Central District of California on 8 December 2020 — almost six years ago. What makes it worth reading is that nothing has changed since, and the document reads like a manual for what is happening now.
Three DPRK nationals are charged with conspiring to steal and extort more than $1.3 billion. According to the indictment they worked for a military intelligence bureau; the security community knows the group as Lazarus and APT38.
None of them was ever arrested.
The valuable part is the list. Each one named, with dates:
Each looked like ordinary software. Inside was code that opened access to the machine — either on install or after an "update".
For iCryptoFx and Union Crypto Trader they created social accounts for employees who did not exist. So the app would have a team, faces, activity — so it would look like a real company.
Checking "do they have staff and reviews" does not catch this. That check was anticipated and answered in advance.
Per the indictment: $75M from a crypto company in Slovenia, $24.9M from one in Indonesia, $11.8M from a financial services company in New York — that last one through CryptoNeuro Trader.
A separate strand is Marine Chain, a token for fractional ownership of cargo ships. Funds were raised through an ICO without disclosing to investors who the organisers were, or that one purpose was evading sanctions.
The method has not changed in six years. Only the names do: the 2020 list is closed, and other names already took its place. Which is why memorising names is useless.
Two things are not.
An app cannot steal what it has no access to. A seed on paper, and serious amounts on a device where that seed was never typed, survive any infection.
And second: even when an app looks flawless, the address it asks you to send to can be screened in ten seconds — and that part cannot be faked.
Screen an address for free: https://t.me/amlconsensus_bot?start=en Live feed of freezes and theft: https://api.amlconsensus.com/theftwatch/?lang=en
Consensus of sources · verdict across 17 chains · connection graph and full audit across 35+ · PDF with QR verification
Open @amlconsensus_bot — 3 free checks every day + 1 full MistTrack check a month
AML