Key Takeaways:

• ZachXBT’s April 8 investigation exposed a DPRK IT worker payment server that processed over $3.5 million since late November 2025.
• Three OFAC-sanctioned entities, Sobaeksu, Saenal, and Songkwang, appeared in the breached user list from luckyguys.site.
• The internal DPRK site went offline on April 9, 2026, but ZachXBT archived all data before publishing the 11-part thread.

North Korean Hackers Used Default Password ‘123456’ on Internal Crypto Payment Server

The leaked data came from a DPRK IT worker’s device compromised by infostealer malware. An unnamed source shared the files with ZachXBT, who confirmed the material had never been publicly released. The extracted records included approximately 390 accounts,…