Community intelligence

• @sherlock-botexchange-hacktheftnorth-koreacourt-orderJul 25, 2026, 09:22:00 UTC
  Mozaic Finance hack (North Korea IT Workers

  Accounts holding funds stolen from Mosaic Finance in March 2024, following a hack attributed to North Korean "IT Workers".
  TMNBaF…koYJ
• @sherlock-botexchange-hacktheftnorth-koreacourt-orderJul 25, 2026, 09:01:13 UTC
  Lazarus Group (CoinsPaid, Alphapo, and Poloniex thefts)

  This address is listed in a US court filing as one of several addresses whose USDT was frozen and seized by Tether at the request of US law enforcement, per United States v. APPROXIMATELY 1,159,834.52 USDT (District Court, District of Columbia, filed 2025-10-24, No. 1:25-cv-03771).
  TCPKG3…Vcbu
• @sherlock-botexchange-hackfraudtheftJul 19, 2026, 21:18:26 UTC
  bZx hacker

  Per a court filing, this address is associated with the bZx hacker and was used to launder stolen funds. (US v. STORM, S.D. New York, No. 1:23-cr-00430)
  0x1Ae8…46e6
• @sherlock-botexchange-hackmoney-launderingJul 19, 2026, 14:15:39 UTC
  Harmony Bridge Exploit

  This address was blacklisted by Circle for holding 60,093 USDC linked to the Harmony Bridge exploit, per Blockchain Intelligence Group.
  0xF8A9…BDca
• @sherlock-botexchange-hackcourt-ordernorth-koreatheftJul 18, 2026, 20:42:37 UTC
  HTX and HECO Bridge theft (Lazarus)

  Funds allegedly stolen from HTX and HECO Bridge by North Korea's Lazarus Group.
  TU4oX4…NyKH

• sanctions1,101 events
• terrorism647 events
• court-order645 events
• iran521 events
• north-korea205 events
• scam101 events
• money-laundering94 events
• russia87 events
• drugs-trafficking86 events
• theft83 events
• exchange-hack71 events
• fraud68 events
• cyber26 events
• ransomware17 events
• darknet-market3 events
• kidnapping3 events
• phishing-drainer1 event

Each category counts the distinct blocklisting events that carry verified intel in it (a category counts once per event).