★ Deployer linked within 3 hops to DPRK/Lazarus
A dev identity & insider risk factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor determines whether the protocol's deployer address, or any address that funded or was funded by it, can be connected within three on-chain hops to a wallet cluster attributed to DPRK's Lazarus Group or affiliated threat actors, as maintained by Chainalysis, OFAC designations, or the curator's own cluster database. Measurement is programmatic using on-chain graph traversal against a continuously updated sanctions and attribution cluster feed. Category 7 context: nation-state developer implants are the highest-severity insider risk class; once a DPRK-linked developer holds admin keys, the timeline to drain is determined by strategic considerations rather than technical vulnerabilities.
**Why it matters** DPRK's Lazarus Group and affiliated units (UNC4736, TraderTraitor) have been responsible for the largest sustained wave of cryptocurrency theft in history. The attack pattern involves embedding developers with falsified credentials into protocol teams, building operational credibility over weeks to months, then executing a coordinated drain using pre-positioned signing authority. Orbit Bridge ($81.5M), Munchables ($62.5M), and Radiant Capital II ($53M) all show confirmed or highly-probable DPRK attribution in the database. LNDFi confirms the pattern extends to smaller protocols. The Drift Protocol incident ($285M, April 2026) demonstrates that nation-state actors now operate at scale across Solana and non-EVM chains.
**Green / Yellow / Red** Green is scored when on-chain graph analysis confirms no path within three hops from the deployer to any DPRK-attributed cluster address in the current feed. Yellow applies when a three-hop path exists to a cluster with low-confidence attribution (suspected but not OFAC-designated or Chainalysis-confirmed). Red is scored when a confirmed path of three hops or fewer connects the deployer to a high-confidence DPRK-attributed cluster, triggering the critical flag regardless of other scores.
**Common gray cases** Gray is assigned when the cluster feed is stale (not refreshed within 30 days), when the protocol operates on a chain where attribution data coverage is materially incomplete, or when intermediate wallets show high-risk patterns but attribution confidence falls below the threshold.
**Notable historical examples** - **Orbit Bridge** ($81.5M, 2023): Deployer linked to DPRK cluster; largest attributable nation-state bridge exploit in database. - **Munchables** ($62.5M, 2024): DPRK IT worker employed as developer; funds returned under pressure. - **Radiant Capital II** ($53M, 2024): Suspected DPRK attribution; multisig key compromise across BSC and Arbitrum. - **LNDFi** ($1.18M, 2025): Pseudonymous team with DPRK IT worker involvement; confirms pattern extends below $10M protocols.
**★ Critical factor** A confirmed three-hop DPRK/Lazarus cluster link on the deployer address alone is sufficient to trigger an F grade under rubric v1.7.0; this represents an active nation-state threat actor with demonstrated capability and intent to execute full-drain exploits.
Measurement what to look for #
Determine whether the deployer address has an on-chain path of ≤3 hops to a Chainalysis/OFAC DPRK-labeled cluster address.