Community intelligence
Verified context on blocklisted addresses comes from the community. Earn a star for every submission an admin verifies - submit intel from any event page.
- @sherlock-botnorth-koreatheftexchange-hackAug 28, 2026, 13:50:05 UTCBybit hack (USDT theft)This address is reported by Bitrace monitoring data to be linked to the Bybit hack, where hackers stole funds from the exchange. It was frozen by Tether and Circle alongside other addresses associated with the incident.TAJmG7…i9QS
- @sherlock-botexchange-hacknorth-koreacourt-orderAug 28, 2026, 13:50:02 UTCSolareum theft funds (NK IT Workers)Funds stolen from users of the Solareum trading bot app, allegedly by North Korean "IT Workers".0xD7AD…5941
- @sherlock-botsanctionsnorth-koreaJul 25, 2026, 09:32:46 UTCLazarus GroupThis address is associated with the Lazarus Group, a North Korean state-sponsored hacking group, as indicated by the US Treasury OFAC sanctions list.0x2690…8c89
- @sherlock-botnorth-koreasanctionsJul 25, 2026, 09:32:45 UTCTornado CashThis address is a Tornado.Cash pool for 50,000 cDAI increments, as listed on Etherscan and attributed by GraphSense. It was also included in the US Treasury OFAC sanctions list for Tornado.Cash.0xd8D7…6193
- @sherlock-botexchange-hacktheftnorth-koreacourt-orderJul 25, 2026, 09:22:00 UTCMozaic Finance hack (North Korea IT WorkersAccounts holding funds stolen from Mosaic Finance in March 2024, following a hack attributed to North Korean "IT Workers".TMNBaF…koYJ
- @sherlock-botexchange-hacktheftnorth-koreacourt-orderJul 25, 2026, 09:01:13 UTCLazarus Group (CoinsPaid, Alphapo, and Poloniex thefts)This address is listed in a US court filing as one of several addresses whose USDT was frozen and seized by Tether at the request of US law enforcement, per United States v. APPROXIMATELY 1,159,834.52 USDT (District Court, District of Columbia, filed 2025-10-24, No. 1:25-cv-03771).TCPKG3…Vcbu
- @sherlock-botsanctionsnorth-koreamoney-launderingJul 25, 2026, 09:01:10 UTCNorth Korean IT WorkerThis address is identified as one of the 'IT Worker Consolidation Addresses' in a US court filing related to money laundering and sanctions evasion conspiracies involving North Korean IT workers. The address was frozen by Tether on April 1, 2023, as part of the 'Frozen Defendant Property' (District Court, District of Columbia, No. 1:25-cv-01769).0x6E2F…D530
- @sherlock-bottheftnorth-koreacourt-orderJul 25, 2026, 08:46:33 UTCNorth Korean IT Wirkers theftThis address is listed as Defendant Property 5 in a US court filing related to a case involving approximately 942,462.845 USDT.0xC955…30C4
- @sherlock-botsanctionsmoney-launderingnorth-koreaJul 25, 2026, 08:46:27 UTCNorth Korean IT Worker Consolidation AddressThis address is identified as one of the 'IT Worker Consolidation Addresses' in a court filing related to money laundering and sanctions evasion conspiracies involving North Korean IT workers. The address was frozen by Tether on April 1, 2023, as part of the case United States v. VIRTUAL CURRENCY ASSOCIATED WITH NORTH KOREAN IT WORKER MONEY LAUNDERING AND SANCTIONS EVASION CONSPIRACIES (District Court, District of Columbia, filed 2025-06-05, No. 1:25-cv-01769).0x1582…7028
Most-reported categories
- sanctions11,763 events
- terrorism4,337 events
- iran3,026 events
- money-laundering2,886 events
- court-order2,512 events
- north-korea2,393 events
- fraud1,329 events
- russia1,083 events
- darknet-market1,060 events
- cyber886 events
- drugs-trafficking712 events
- scam406 events
- ransomware301 events
- theft204 events
- exchange-hack187 events
- kidnapping8 events
- phishing-drainer2 events
Each category counts the distinct blocklisting events that carry verified intel in it (a category counts once per event).
Top contributors
- 1@sherlock-bot1844
- 2@satoshi1