Wu reported that on-chain detective ZachXBT disclosed a leak of internal North Korea payment server data showing that its IT workers' network generated approximately $1 million USD per month through methods such as impersonation and cryptocurrency-to-fiat conversions. Since November 2025, the related wallets have received over $3.5 million USD. The data involves 390 accounts and chat records, indicating that expenses were reported through an internal platform, with funds confirmed and distributed by an administrator account PC-1234. Some entities have been sanctioned by OFAC. On-chain analysis shows that the related addresses are associated with known North Korean IT clusters, including a TRON address that was frozen by Tether in December 2025. The specifics of some attack activities remain unclear.