Contributor paid to DPRK-cluster wallet

Methodology how we score #

**What this measures** This factor checks whether protocol payments to any contributor's wallet — salary, bounty, or grant transactions from the protocol treasury or multisig — have an on-chain path within three hops to a known DPRK-attributed cluster address. This is distinct from RD-F-125 (which examines the deployer wallet) and focuses specifically on payroll-flow routing. Measurement is programmatic: on-chain graph traversal from treasury outflows to contributor wallets, then forward-tracing from those wallets to known DPRK cluster addresses. Category 7 context: payroll routing is the operational money-flow layer of DPRK IT worker infiltration; profits are laundered through a chain of intermediate wallets to DPRK-controlled cluster addresses.

**Why it matters** FBI, CISA, and blockchain analytics firms have documented that DPRK IT workers route earnings through a predictable layering chain: personal wallet → mixer or exchange → DPRK-controlled consolidation address. The on-chain path often becomes visible within three to six hops from the contributor wallet. Orbit Bridge, Munchables, Radiant Capital II, and LNDFi all show patterns where contributor wallet flows can be traced toward DPRK-attributed clusters. This factor is P1 (not P0★) because confirming the path requires active Chainalysis-feed access and curator interpretation; it is strong corroborating evidence for RD-F-125 but not independently critical.

**Green / Yellow / Red** Green is scored when on-chain analysis of contributor payment flows shows no path within three hops to DPRK-attributed cluster addresses. Yellow applies when a path exists to a cluster with medium-confidence attribution, or when an intermediate wallet shows high-risk patterns (mixer, OFAC-adjacent) without confirmed DPRK labeling. Red is scored when a confirmed three-hop path connects protocol treasury outflows through a contributor wallet to a high-confidence DPRK-attributed cluster address.

**Common gray cases** Gray is assigned when the protocol treasury operates via a DAO with diffuse on-chain disbursements that are impractical to trace per-contributor, or when the cluster feed lacks sufficient coverage of the relevant chain.

**Notable historical examples** - **Orbit Bridge** ($81.5M, 2023): Contributor payment routing to DPRK cluster confirmed in post-exploit attribution analysis. - **Munchables** ($62.5M, 2024): DPRK IT worker salary payments routed toward DPRK-attributed consolidation addresses. - **Radiant Capital II** ($53M, 2024): Suspected DPRK payroll routing identified in post-mortem blockchain analysis.

Measurement what to look for #

Determine whether protocol payments to any contributor wallet have an on-chain path ≤3 hops to a known DPRK-labeled cluster.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 9 historical incidents #