Community intelligence

• @sherlock-botsanctionsnorth-koreaJul 25, 2026, 09:32:46 UTC
  Lazarus Group

  This address is associated with the Lazarus Group, a North Korean state-sponsored hacking group, as indicated by the US Treasury OFAC sanctions list.
  0x2690…8c89
• @sherlock-botnorth-koreasanctionsJul 25, 2026, 09:32:45 UTC
  Tornado Cash

  This address is a Tornado.Cash pool for 50,000 cDAI increments, as listed on Etherscan and attributed by GraphSense. It was also included in the US Treasury OFAC sanctions list for Tornado.Cash.
  0xd8D7…6193
• @sherlock-botexchange-hacktheftnorth-koreacourt-orderJul 25, 2026, 09:22:00 UTC
  Mozaic Finance hack (North Korea IT Workers

  Accounts holding funds stolen from Mosaic Finance in March 2024, following a hack attributed to North Korean "IT Workers".
  TMNBaF…koYJ
• @sherlock-botexchange-hacktheftnorth-koreacourt-orderJul 25, 2026, 09:01:13 UTC
  Lazarus Group (CoinsPaid, Alphapo, and Poloniex thefts)

  This address is listed in a US court filing as one of several addresses whose USDT was frozen and seized by Tether at the request of US law enforcement, per United States v. APPROXIMATELY 1,159,834.52 USDT (District Court, District of Columbia, filed 2025-10-24, No. 1:25-cv-03771).
  TCPKG3…Vcbu
• @sherlock-botsanctionsnorth-koreamoney-launderingJul 25, 2026, 09:01:10 UTC
  North Korean IT Worker

  This address is identified as one of the 'IT Worker Consolidation Addresses' in a US court filing related to money laundering and sanctions evasion conspiracies involving North Korean IT workers. The address was frozen by Tether on April 1, 2023, as part of the 'Frozen Defendant Property' (District Court, District of Columbia, No. 1:25-cv-01769).
  0x6E2F…D530
• @sherlock-bottheftnorth-koreacourt-orderJul 25, 2026, 08:46:33 UTC
  North Korean IT Wirkers theft

  This address is listed as Defendant Property 5 in a US court filing related to a case involving approximately 942,462.845 USDT.
  0xC955…30C4
• @sherlock-botsanctionsmoney-launderingnorth-koreaJul 25, 2026, 08:46:27 UTC
  North Korean IT Worker Consolidation Address

  This address is identified as one of the 'IT Worker Consolidation Addresses' in a court filing related to money laundering and sanctions evasion conspiracies involving North Korean IT workers. The address was frozen by Tether on April 1, 2023, as part of the case United States v. VIRTUAL CURRENCY ASSOCIATED WITH NORTH KOREAN IT WORKER MONEY LAUNDERING AND SANCTIONS EVASION CONSPIRACIES (District Court, District of Columbia, filed 2025-06-05, No. 1:25-cv-01769).
  0x1582…7028
• @sherlock-botsanctionsnorth-koreamoney-launderingJul 25, 2026, 08:11:17 UTC
  North Korea IT Worker

  This address is associated with North Korea IT Worker as per a court filing and received/sent USDC to/from a blacklisted address linked to the same entity.
  0x5707…8AB5
• @sherlock-botsanctionsnorth-koreamoney-launderingJul 25, 2026, 08:11:08 UTC
  North Korea IT Worker Consolidation Addresses

  This address is identified as one of the 'IT Worker Consolidation Addresses' in a court filing related to money laundering and sanctions evasion conspiracies involving North Korean IT workers. The address was frozen by Tether on or about March 6, 2023, and is part of the 'Frozen Defendant Property' as described in the court document.
  0xB389…8A72

• sanctions1,101 events
• terrorism647 events
• court-order645 events
• iran521 events
• north-korea205 events
• scam101 events
• money-laundering94 events
• russia87 events
• drugs-trafficking86 events
• theft83 events
• exchange-hack71 events
• fraud68 events
• cyber26 events
• ransomware17 events
• darknet-market3 events
• kidnapping3 events
• phishing-drainer1 event

Each category counts the distinct blocklisting events that carry verified intel in it (a category counts once per event).